You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@metron.apache.org by Nick Allen <ni...@nickallen.org> on 2017/01/25 21:32:02 UTC
[Discuss] Geo Enrichment with Stellar
As part of Justin's work on PR 421
<https://github.com/apache/incubator-metron/pull/421> [1], he added a
rather slick little Stellar function that lets you query for location data
based on an IP; GEO_GET("200.200.200.200").
We currently use a separate bolt to perform geo-enrichment. With Justin's
PR and a little additional work, it would be possible to replace the
existing mechanism for geo-enrichment, with one driven by Stellar.
Geo-enrichment just becomes a Stellar function call.
The advantage here is that it could...
- Simplify the configuration for the user
- Simplify the underlying enrichment topology
I may be reaching a little too far, but it might be possible to collapse
all forms of enrichment to Stellar. Hmm... that might be interesting.
See the original discussion here.
<https://github.com/apache/incubator-metron/pull/421#discussion_r97878462>
[2]
--
[1] https://github.com/apache/incubator-metron/pull/421
[2] https://github.com/apache/incubator-metron/pull/421#discussion_r97878462
--
Nick Allen <ni...@nickallen.org>
Re: [Discuss] Geo Enrichment with Stellar
Posted by Nick Allen <ni...@nickallen.org>.
I just haven't looked closely enough at the code or tried it myself, to say
that it works today. We may very well have all we need.
On Wed, Jan 25, 2017 at 4:34 PM, Casey Stella <ce...@gmail.com> wrote:
> Maybe off topic for this discussion, but what is the additional work? I
> *think* Justin's PR could be used to completely replace the non-stellar geo
> enrichment, but I'm curious if I missed something.
>
> On Wed, Jan 25, 2017 at 4:32 PM, Nick Allen <ni...@nickallen.org> wrote:
>
> > As part of Justin's work on PR 421
> > <https://github.com/apache/incubator-metron/pull/421> [1], he added a
> > rather slick little Stellar function that lets you query for location
> data
> > based on an IP; GEO_GET("200.200.200.200").
> >
> > We currently use a separate bolt to perform geo-enrichment. With
> Justin's
> > PR and a little additional work, it would be possible to replace the
> > existing mechanism for geo-enrichment, with one driven by Stellar.
> > Geo-enrichment just becomes a Stellar function call.
> >
> > The advantage here is that it could...
> >
> > - Simplify the configuration for the user
> > - Simplify the underlying enrichment topology
> >
> > I may be reaching a little too far, but it might be possible to collapse
> > all forms of enrichment to Stellar. Hmm... that might be interesting.
> >
> > See the original discussion here.
> > <https://github.com/apache/incubator-metron/pull/421#
> discussion_r97878462>
> > [2]
> >
> > --
> >
> >
> > [1] https://github.com/apache/incubator-metron/pull/421
> > [2] https://github.com/apache/incubator-metron/pull/421#
> > discussion_r97878462
> >
> >
> >
> > --
> > Nick Allen <ni...@nickallen.org>
> >
>
--
Nick Allen <ni...@nickallen.org>
Re: [Discuss] Geo Enrichment with Stellar
Posted by Casey Stella <ce...@gmail.com>.
Maybe off topic for this discussion, but what is the additional work? I
*think* Justin's PR could be used to completely replace the non-stellar geo
enrichment, but I'm curious if I missed something.
On Wed, Jan 25, 2017 at 4:32 PM, Nick Allen <ni...@nickallen.org> wrote:
> As part of Justin's work on PR 421
> <https://github.com/apache/incubator-metron/pull/421> [1], he added a
> rather slick little Stellar function that lets you query for location data
> based on an IP; GEO_GET("200.200.200.200").
>
> We currently use a separate bolt to perform geo-enrichment. With Justin's
> PR and a little additional work, it would be possible to replace the
> existing mechanism for geo-enrichment, with one driven by Stellar.
> Geo-enrichment just becomes a Stellar function call.
>
> The advantage here is that it could...
>
> - Simplify the configuration for the user
> - Simplify the underlying enrichment topology
>
> I may be reaching a little too far, but it might be possible to collapse
> all forms of enrichment to Stellar. Hmm... that might be interesting.
>
> See the original discussion here.
> <https://github.com/apache/incubator-metron/pull/421#discussion_r97878462>
> [2]
>
> --
>
>
> [1] https://github.com/apache/incubator-metron/pull/421
> [2] https://github.com/apache/incubator-metron/pull/421#
> discussion_r97878462
>
>
>
> --
> Nick Allen <ni...@nickallen.org>
>