You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@metron.apache.org by "Laurens Vets (JIRA)" <ji...@apache.org> on 2018/01/22 19:14:00 UTC
[jira] [Assigned] (METRON-1415) match statement does not seem to
work.
[ https://issues.apache.org/jira/browse/METRON-1415?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Laurens Vets reassigned METRON-1415:
------------------------------------
Assignee: Otto Fowler (was: Laurens Vets)
> match statement does not seem to work.
> --------------------------------------
>
> Key: METRON-1415
> URL: https://issues.apache.org/jira/browse/METRON-1415
> Project: Metron
> Issue Type: Bug
> Affects Versions: 0.4.2
> Reporter: Laurens Vets
> Assignee: Otto Fowler
> Priority: Major
>
> I had the following code in my Sensor Enrichment Config:
> {code:java}
> {
> "enrichment": {
> "fieldMap": {
> "stellar": {
> "config": {
> "AWSEventSourceAccount": "match{recipientAccountID == 1111111111L => 'account1', recipientAccountID == 2222222222L => 'account2', recipientAccountID == 333333333L => 'account3', recipientAccountID == 4444444444L => 'account4', recipientAccountID == 5555555555L => 'account4', recipientAccountID == 6666666666L => 'account6', default => 'Unknown Account.'}"
> }
> }
> },
> "fieldToTypeMap": {},
> "config": {}
> },{code}
> However, this did not work as expected and the AWSEventSourceAccount field would always return "Unknown Account" in my events.
> According to [~ottobackwards], this does work in the Stellar shell. He asked me to test with "_source.recipientAccountID" instead of "recipientAccountID" and make sure that mapStrategy is set to UNFOLD (this was already the case).
> However, using this in my enrichment config does not resolve the issue. I used:
> {code:java}
> {
> "enrichment": {
> "fieldMap": {
> "stellar": {
> "config": {
> "AWSEventSourceAccount": "match{_source.recipientAccountID == 1111111111L => 'account1', _source.recipientAccountID == 2222222222L => 'account2', _source.recipientAccountID == 333333333L => 'account3', _source.recipientAccountID == 4444444444L => 'account4', _source.recipientAccountID == 5555555555L => 'account4', _source.recipientAccountID == 6666666666L => 'account6', default => 'Unknown Account.'}"
> }
> }
> },
> "fieldToTypeMap": {},
> "config": {}
> },{code}
>
>
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)