Github user ottobackwards commented on the issue:
https://github.com/apache/metron/pull/995
I am thinking of the metron as a framework POV here. Right now, someone
can create a parser, an enrichment a (in this PR's world) solr/es schema for
their input.
This PR makes assumptions about a single use case, but the platform allows
the capability for this to happen in many other ways that are beyond the
control or knowledge of the 'core' platform through the platform's
extensibility.
That makes any remediation of this issue a 'one' off it assumes knowledge
of the data, which the platform cannot have beyond the parsers that ship. And
even then that knowledge ( based on the known configuration ) is not reliable
because they are examples and can be modified.
Does that make sense or am I missing something?
---
