[jira] [Commented] (METRON-1606) Add a 'wrap' to incoming messages in the metron json parser

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/METRON-1606?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16541813#comment-16541813 ] 

ASF GitHub Bot commented on METRON-1606:
----------------------------------------

Github user ottobackwards closed the pull request at:

    https://github.com/apache/metron/pull/1054


> Add a 'wrap' to incoming messages in the metron json parser
> -----------------------------------------------------------
>
>                 Key: METRON-1606
>                 URL: https://issues.apache.org/jira/browse/METRON-1606
>             Project: Metron
>          Issue Type: Improvement
>            Reporter: Laurens Vets
>            Assignee: Otto Fowler
>            Priority: Minor
>
> For many use cases, the user may not have control over the format of the json that is coming in.  Some services send 'documents' with many atomic json entries, that are not in a coherent array, and cannot be referenced or parsed.
>  
> It would be useful to simply have the option for the JSONMap parser to be configured to 'wrap' the incoming document in an array and holding entity.  This would allow it to be parsed and addressed by JSONPath.
>  
> {data},
> {data},
> {data},
>  
> wraps to:
>  
> { "wrapName" : [
> {data},
> {data},
> {data}
> ]
> }
>  
> that can be then referenced by a jsonPath statement : $.wrapperName[*]  or something more complex
>  
> So you would configure the parser
> {code:java}
> wrapIncomming : 'true' # This wraps the incomming bytes in a json construct, { NAME : [ CONTENT ] }{code}
> {code:java}
> .wrapContructName : 'messages' # default name for the wrapping construct, this name should be referenced in your jsonpath statement{code}
>  
> The assumption here is that the entities, while not wrapped or in an array, are still comma separated.
>  



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)