Enrichment rule

[vklimontovich]

Concept

Enrichment rule is a piece of business logic that transforms original JSON event. The rule properties are:

• Input: JSON node path as /json/path
• Output: JSON node path as /json/out
• Rule: string

The rule takes should be represented as F(json_node) → json_node.

Supported rules

So far we need to support two rules:

• ip_lookup
• user_agent_parse

We already have the code, we just need to wrap it into new structures.

Rules configuration

Rules should be configured on per destination basis:

destinations:
  destination_name:
    enrichment:
       - 
          name: ip_lookup
          from: /ip_address
          to: /geo/

Implicit rules

Some rules should always exist. They mainly needed for events coming from web browser

    enrichment:
       - 
          name: ip_lookup
          from: /source_ip
          to: /eventn_ctx/location
       - 
          name:  user_agent_parse
          from: /eventn_ctx/user_agent
          to: /eventn_ctx/parsed_ua     

Also, It is supported in server to server integration

    enrichment:
       - 
          name: ip_lookup
          from: /device_ctx/location/ip
          to: /eventn_ctx/location
       - 
          name:  user_agent_parse
          from: /device_ctx/user_agent
          to: /eventn_ctx/parsed_ua