Change data in filed

[Anonymous]

Hello,

Maybe someone know how I can transform username or any other meta key from format1 to format2. For example, events from event source 1 come to SA in format "firstname.lastname", events from event source 2 come to SA in format "firstname lastname". Does anyone known how I can transform format 1 to format 2 or vice versa?

[Anonymous · Accepted solution]

If I read the question correctly, the difference is the dot "." in event source 1 vs a [space] in event source 2.

A parser with a meta callback should be able to do this.  If it is coming from a log source, I would suggest adjusting the parser to write to a temporary transient meta key.  Then, create a lua parser that will pick up the meta from the transient meta key, perform the string manipulation, and then write to the meta key of your choice (probably a common one to stay consistent).

Lua framework could look like this:

> tempuser = "chris.ahearn"

> myuser = string.gsub(tempuser, "%.", " ")

> print(myuser)

chris ahearn

> tempuser = "chris ahearn"

> myuser = string.gsub(tempuser, " ", ".")

> print(myuser)

chris.ahearn

[RSAAdmin]

Hi! What is "parser with a meta callback"? Is this callback can be used with events comes from log source?

Could you please share some docs about lua parsers example and usage?

[Anonymous]

A parser with a meta callback is basically reaching into the database for meta that was previously written.  For example, if i needed to perform some kind of string manipulation on 'alias.host', I would issue that as my token match as opposed to something from the raw network stream.

function roothost:hostMeta(index, host)

     rootDomain = do something

     nw.createMeta(self.keys["root.host"], rootDomain)

end

roothost:setCallbacks({

    [nwlanguagekey.create("alias.host")] = roothost.hostMeta,

    [nwevents.OnSessionEnd] = roothost.sessionEnd,

})

It is another way of doing something with meta that was previously added to the database...whether it was written or labeled as transient, which would not get written when the session was over.