You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@metron.apache.org by cestella <gi...@git.apache.org> on 2016/09/19 22:21:39 UTC
[GitHub] incubator-metron pull request #261: METRON-434: JSON Parser
GitHub user cestella opened a pull request:
https://github.com/apache/incubator-metron/pull/261
METRON-434: JSON Parser
There are some situations where your data is already in JSON form and parsing should be as simple as passing the data through, adding `timestamp` and `original_message` along the way. This JIRA will create a parser which will take a JSON map in.
Since we have standardized on one-dimensional maps, we must handle data which contains inner maps. Inner maps should be handled pluggably by doing one of the following (configurably):
* doing nothing
* unfolding maps (e.g. `{ "foo" : { "bar" : 7 } }` is transformed into `{"foo.bar" : 7 }`)
* throwing an exception
* dropping the inner map
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/cestella/incubator-metron METRON-434
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/incubator-metron/pull/261.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #261
----
commit 0c8bb5c4ab04f9e19859981cea5bfe58b868a16f
Author: cstella <ce...@gmail.com>
Date: 2016-09-07T20:47:03Z
Initial commit for identity parser.
commit 151a54b07832aef82c95a4fd59a2b0a0bc30e005
Author: cstella <ce...@gmail.com>
Date: 2016-09-19T13:07:28Z
Merge branch 'master' into identity_parser
commit ffa7b5297f4013aa7aa364f49bae1c2eb6c4ee3a
Author: cstella <ce...@gmail.com>
Date: 2016-09-19T15:13:07Z
updating to have a handler for maps.
commit 68be22f5e1b72172e415909340c121c974651414
Author: cstella <ce...@gmail.com>
Date: 2016-09-19T22:14:04Z
METRON-434: JSON Parser
commit 860e8302cb1edf0c9178b37093a7930cd068ff92
Author: cstella <ce...@gmail.com>
Date: 2016-09-19T22:17:49Z
Merge branch 'identity_parser' into METRON-434
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #261: METRON-434: JSON Parser
Posted by mmiklavc <gi...@git.apache.org>.
Github user mmiklavc commented on the issue:
https://github.com/apache/incubator-metron/pull/261
Looks good, +1
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #261: METRON-434: JSON Parser
Posted by cestella <gi...@git.apache.org>.
Github user cestella commented on the issue:
https://github.com/apache/incubator-metron/pull/261
Yep, make a JIRA first and then submit the PR with the JIRA name as the first part, like this one is.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron pull request #261: METRON-434: JSON Parser
Posted by asfgit <gi...@git.apache.org>.
Github user asfgit closed the pull request at:
https://github.com/apache/incubator-metron/pull/261
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron pull request #261: METRON-434: JSON Parser
Posted by cestella <gi...@git.apache.org>.
Github user cestella closed the pull request at:
https://github.com/apache/incubator-metron/pull/261
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron pull request #261: METRON-434: JSON Parser
Posted by mmiklavc <gi...@git.apache.org>.
Github user mmiklavc commented on a diff in the pull request:
https://github.com/apache/incubator-metron/pull/261#discussion_r79625878
--- Diff: metron-platform/metron-parsers/src/test/java/org/apache/metron/parsers/json/JSONMapParserTest.java ---
@@ -0,0 +1,112 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.metron.parsers.json;
+
+import com.google.common.collect.ImmutableMap;
+import org.adrianwalker.multilinestring.Multiline;
+import org.json.simple.JSONObject;
+import org.junit.Assert;
+import org.junit.Test;
+
+import java.util.List;
+import java.util.Map;
+
+public class JSONMapParserTest {
+
+ /**
+ {
+ "foo" : "bar"
+ ,"blah" : "blah"
+ ,"number" : 2.0
+ }
+ */
+ @Multiline
+ static String happyPathJSON;
+
+ @Test
+ public void testHappyPath() {
+ JSONMapParser parser = new JSONMapParser();
+ List<JSONObject> output = parser.parse(happyPathJSON.getBytes());
+ Assert.assertEquals(output.size(), 1);
+ //don't forget the timestamp field!
+ Assert.assertEquals(output.get(0).size(), 5);
+ JSONObject message = output.get(0);
+ Assert.assertEquals("bar", message.get("foo"));
+ Assert.assertEquals("blah", message.get("blah"));
+ Assert.assertNotNull(message.get("timestamp"));
+ Assert.assertTrue(message.get("timestamp") instanceof Number);
+ Assert.assertNotNull(message.get("number"));
+ Assert.assertTrue(message.get("number") instanceof Number);
+ }
+
+ /**
+ {
+ "collection" : { "blah" : 7, "blah2" : "foo" }
+ }
+ */
+ @Multiline
+ static String collectionHandlingJSON;
+
+ @Test
+ public void testCollectionHandlingDrop() {
+ JSONMapParser parser = new JSONMapParser();
+ List<JSONObject> output = parser.parse(collectionHandlingJSON.getBytes());
+ Assert.assertEquals(output.size(), 1);
+ //don't forget the timestamp field!
+ Assert.assertEquals(output.get(0).size(), 2);
+ JSONObject message = output.get(0);
+ Assert.assertNotNull(message.get("timestamp"));
+ Assert.assertTrue(message.get("timestamp") instanceof Number);
+ }
+
+ @Test(expected=IllegalStateException.class)
+ public void testCollectionHandlingError() {
+ JSONMapParser parser = new JSONMapParser();
+ parser.configure(ImmutableMap.of("mapStrategy", "ERROR"));
+ List<JSONObject> output = parser.parse(collectionHandlingJSON.getBytes());
+ }
+
+
+ @Test
+ public void testCollectionHandlingAllow() {
+ JSONMapParser parser = new JSONMapParser();
+ parser.configure(ImmutableMap.of("mapStrategy", "ALLOW"));
--- End diff --
Could strings instead reference the enums directly? e.g. MapStrategy.ALLOW.name()
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #261: METRON-434: JSON Parser
Posted by cestella <gi...@git.apache.org>.
Github user cestella commented on the issue:
https://github.com/apache/incubator-metron/pull/261
@ottobackwards That's correct. This is a general purpose parser and you could have multiple instances of it.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #261: METRON-434: JSON Parser
Posted by ottobackwards <gi...@git.apache.org>.
Github user ottobackwards commented on the issue:
https://github.com/apache/incubator-metron/pull/261
Is it correct that multiple separate instances of this parser ( or any parser ) could be configured by adding multiple zookeeper jsons with separate kafka topics?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #261: METRON-434: JSON Parser
Posted by ottobackwards <gi...@git.apache.org>.
Github user ottobackwards commented on the issue:
https://github.com/apache/incubator-metron/pull/261
No problem - do you require a jira?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #261: METRON-434: JSON Parser
Posted by cestella <gi...@git.apache.org>.
Github user cestella commented on the issue:
https://github.com/apache/incubator-metron/pull/261
@ottobackwards I think that's great work! Why don't you submit it as a PR after this one gets through?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #261: METRON-434: JSON Parser
Posted by ottobackwards <gi...@git.apache.org>.
Github user ottobackwards commented on the issue:
https://github.com/apache/incubator-metron/pull/261
Should I open a new jira and do a PR?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #261: METRON-434: JSON Parser
Posted by ottobackwards <gi...@git.apache.org>.
Github user ottobackwards commented on the issue:
https://github.com/apache/incubator-metron/pull/261
METRON-449
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #261: METRON-434: JSON Parser
Posted by ottobackwards <gi...@git.apache.org>.
Github user ottobackwards commented on the issue:
https://github.com/apache/incubator-metron/pull/261
Casey, would you feel about adding in recursion, such that nested maps will be unfolded?
I have that working.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #261: METRON-434: JSON Parser
Posted by cestella <gi...@git.apache.org>.
Github user cestella commented on the issue:
https://github.com/apache/incubator-metron/pull/261
@ottobackwards Regarding your other question, we mandated that every message capture the original message and a timestamp as required fields. If the message doesn't have that, then it fails validation and an error is thrown for that message.
Certainly after it's parsed, you can apply a stellar transformation and replace the timestamp field with another one using Stellar.
There is currently a bug where we apply stellar transformations AFTER that validation happens, so we don't have the ability to specify a timestamp via stellar if it is not there already. If we had that fixed, then we could apply the timestamp to the message in stellar, for sure.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #261: METRON-434: JSON Parser
Posted by ottobackwards <gi...@git.apache.org>.
Github user ottobackwards commented on the issue:
https://github.com/apache/incubator-metron/pull/261
I have a question -
Shouldn't the addition of the timestamp and the original string be something that is handled in Stellar?
I am looking at running something through this with a field that I would want to transform with stellar into the timestamp. Incoming data from other systems ( SIEMs etc ) may already be normalized and have a raw log data field as well. I would think that Stellar would be the better place to these things.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron pull request #261: METRON-434: JSON Parser
Posted by cestella <gi...@git.apache.org>.
GitHub user cestella reopened a pull request:
https://github.com/apache/incubator-metron/pull/261
METRON-434: JSON Parser
There are some situations where your data is already in JSON form and parsing should be as simple as passing the data through, adding `timestamp` and `original_message` along the way. This JIRA will create a parser which will take a JSON map in.
Since we have standardized on one-dimensional maps, we must handle data which contains inner maps. Inner maps should be handled pluggably by doing one of the following (configurably):
* doing nothing
* unfolding maps (e.g. `{ "foo" : { "bar" : 7 } }` is transformed into `{"foo.bar" : 7 }`)
* throwing an exception
* dropping the inner map
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/cestella/incubator-metron METRON-434
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/incubator-metron/pull/261.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #261
----
commit 0c8bb5c4ab04f9e19859981cea5bfe58b868a16f
Author: cstella <ce...@gmail.com>
Date: 2016-09-07T20:47:03Z
Initial commit for identity parser.
commit 151a54b07832aef82c95a4fd59a2b0a0bc30e005
Author: cstella <ce...@gmail.com>
Date: 2016-09-19T13:07:28Z
Merge branch 'master' into identity_parser
commit ffa7b5297f4013aa7aa364f49bae1c2eb6c4ee3a
Author: cstella <ce...@gmail.com>
Date: 2016-09-19T15:13:07Z
updating to have a handler for maps.
commit 68be22f5e1b72172e415909340c121c974651414
Author: cstella <ce...@gmail.com>
Date: 2016-09-19T22:14:04Z
METRON-434: JSON Parser
commit 860e8302cb1edf0c9178b37093a7930cd068ff92
Author: cstella <ce...@gmail.com>
Date: 2016-09-19T22:17:49Z
Merge branch 'identity_parser' into METRON-434
commit 3adca211b7836af9b559be72125c2fdab3ac7b44
Author: cstella <ce...@gmail.com>
Date: 2016-09-20T13:17:00Z
licenses
commit 8a725e99fb23bf12973a0778e54cd70b927951e2
Author: cstella <ce...@gmail.com>
Date: 2016-09-20T13:39:26Z
Missed a license.
commit b8af693a85aa5b2ef60e08a528eeb92741a86432
Author: cstella <ce...@gmail.com>
Date: 2016-09-20T15:03:07Z
Updating test.
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron pull request #261: METRON-434: JSON Parser
Posted by cestella <gi...@git.apache.org>.
Github user cestella commented on a diff in the pull request:
https://github.com/apache/incubator-metron/pull/261#discussion_r79632896
--- Diff: metron-platform/metron-parsers/src/test/java/org/apache/metron/parsers/json/JSONMapParserTest.java ---
@@ -0,0 +1,112 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.metron.parsers.json;
+
+import com.google.common.collect.ImmutableMap;
+import org.adrianwalker.multilinestring.Multiline;
+import org.json.simple.JSONObject;
+import org.junit.Assert;
+import org.junit.Test;
+
+import java.util.List;
+import java.util.Map;
+
+public class JSONMapParserTest {
+
+ /**
+ {
+ "foo" : "bar"
+ ,"blah" : "blah"
+ ,"number" : 2.0
+ }
+ */
+ @Multiline
+ static String happyPathJSON;
+
+ @Test
+ public void testHappyPath() {
+ JSONMapParser parser = new JSONMapParser();
+ List<JSONObject> output = parser.parse(happyPathJSON.getBytes());
+ Assert.assertEquals(output.size(), 1);
+ //don't forget the timestamp field!
+ Assert.assertEquals(output.get(0).size(), 5);
+ JSONObject message = output.get(0);
+ Assert.assertEquals("bar", message.get("foo"));
+ Assert.assertEquals("blah", message.get("blah"));
+ Assert.assertNotNull(message.get("timestamp"));
+ Assert.assertTrue(message.get("timestamp") instanceof Number);
+ Assert.assertNotNull(message.get("number"));
+ Assert.assertTrue(message.get("number") instanceof Number);
+ }
+
+ /**
+ {
+ "collection" : { "blah" : 7, "blah2" : "foo" }
+ }
+ */
+ @Multiline
+ static String collectionHandlingJSON;
+
+ @Test
+ public void testCollectionHandlingDrop() {
+ JSONMapParser parser = new JSONMapParser();
+ List<JSONObject> output = parser.parse(collectionHandlingJSON.getBytes());
+ Assert.assertEquals(output.size(), 1);
+ //don't forget the timestamp field!
+ Assert.assertEquals(output.get(0).size(), 2);
+ JSONObject message = output.get(0);
+ Assert.assertNotNull(message.get("timestamp"));
+ Assert.assertTrue(message.get("timestamp") instanceof Number);
+ }
+
+ @Test(expected=IllegalStateException.class)
+ public void testCollectionHandlingError() {
+ JSONMapParser parser = new JSONMapParser();
+ parser.configure(ImmutableMap.of("mapStrategy", "ERROR"));
+ List<JSONObject> output = parser.parse(collectionHandlingJSON.getBytes());
+ }
+
+
+ @Test
+ public void testCollectionHandlingAllow() {
+ JSONMapParser parser = new JSONMapParser();
+ parser.configure(ImmutableMap.of("mapStrategy", "ALLOW"));
--- End diff --
Agreed
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---