squid2_parser_sans_profiler.json

{
	"parserClassName": "org.apache.metron.parsers.GrokParser",
	"filterClassName": null,
	"sensorTopic": "squid2",
	"writerClassName": null,
	"errorWriterClassName": null,
	"invalidWriterClassName": null,
	"readMetadata": false,
	"mergeMetadata": false,
	"numWorkers": null,
	"numAckers": null,
	"spoutParallelism": 1,
	"spoutNumTasks": 1,
	"parserParallelism": 1,
	"parserNumTasks": 1,
	"errorWriterParallelism": 1,
	"errorWriterNumTasks": 1,
	"spoutConfig": {},
	"securityProtocol": null,
	"stormConfig": {},
	"parserConfig": {
		"grokPath": "/patterns/squid",
		"patternLabel": "SQUID_DELIMITED",
		"timestampField": "timestamp"
	},
	"fieldTransformations": [
		{
			"input": [],
			"output": [
				"full_hostname",
				"domain_without_subdomains",
				"is_alert"
			],
			"transformation": "STELLAR",
			"config": {
				"full_hostname": "URL_TO_HOST(url)",
				"domain_without_subdomains": "DOMAIN_REMOVE_SUBDOMAINS(full_hostname)",
				"is_alert": true
			}
		}
	]
}