Administration
Also available as:
PDF
loading table of contents...

Configuring Element-to-Enrichment Mapping

Configure which element of a tuple should be enriched with which enrichment type.

This configuration is stored in ZooKeeper.

  1. Log in as root user to the host that has Metron installed.

  2. Cut and paste the following into a file called enrichment_config_temp.json, being sure to customize $ZOOKEEPER_HOST and $DATASOURCE to your specific values, where $DATASOURCE refers to the name of the datasource that is used to bulk load the enrichment:

    {
         "zkQuorum" : "$ZOOKEEPER_HOST:2181"
        ,"sensorToFieldList" : {
              "$DATASOURCE" : {
                 "type" : "ENRICHMENT"
                ,"fieldToEnrichmentTypes" : {
                     "domain_without_subdomains" : [ "whois" ]
                  }
              }
        }
    }
    
  3. Remove any non-ASCII invisible characters that might have been included when you cut and pasted:

    iconv -c -f utf-8 -t ascii enrichment_config_temp.json -o enrichment_config.json