Description
It would be useful to have a projection transformation for Parsers which could use configured to limit the fields output from the parser.
The configuration would look like this:
{ "fieldTransformations": [ { "transformation": "STELLAR", "config": [ "ipSrc = TRIM(raw_ip_src)" "ip_src_addr := ipSrc" ] }, { "transformation": "SELECT", "output" : [ "ip_src_addr", "ip_dst_addr", "message"] } ] }
This would lead to only the fields in the output definition of the SELECT transformation being put into the outbound message.
Attachments
Issue Links
- links to