I am trying to flatten some dns messages from bro. For some reason having any luck.
I have tranquility 0.8.2 and Druid 0.13.
Attached please find the tranquility logs, sample data and my tranquility spec file. Can somebody point me to the right direction to troubleshoot this.
data (5).json (639 Bytes)
tranquility log.txt (51.8 KB)
bro_dns.tranq.spec.orig (3.91 KB)
I think this is hitting the same issue described here: https://groups.google.com/d/topic/druid-user/2DPFyrpZALk/discussion
There was a bug in JSONPathParser that was fixed in Druid 0.10.0, where even for “root” fields it tries to compile a path from the “expr” field: https://github.com/apache/incubator-druid/commit/151ff6d064d5ff36141f4ac5741111773ca2514b#diff-331c0b9aed8bb0b36ddd1f9801a1fc25
However, Tranquility is still built against an older version of Druid without that fix, so you’ll need to put a non-empty dummy value for “expr” on all of the “root” type fields.