Major Description
It would be useful to have a projection transformation for Parsers which could use configured to limit the fields output from the parser.
The configuration would look like this:
{
"fieldTransformations": [
{
"transformation": "STELLAR",
"config": [
"ipSrc = TRIM(raw_ip_src)"
"ip_src_addr := ipSrc"
]
},
{
"transformation": "SELECT",
"output" : [ "ip_src_addr", "ip_dst_addr", "message"]
}
]
}
This would lead to only the fields in the output definition of the SELECT transformation being put into the outbound message.
Attachments
Issue Links
- links to
