Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

The Kafka Parser Bolt is an extensible bolt that can take two types of parsers: GROK and purpose-built Java.  It is our strong preference to build up as much coverage as we can using the Grok parsers, as they require no coding.  However, the drawback of the Grok parsers is that they are much slower than Java parsers and sometimes the telemetry is so complex that writing a Grok statement for it is not feasible.  See our list of supported devices for which parser type supports a particular device.

...

Parser TypeTelemetry TypeParser Reference
GrokSimple to parse, low volumeGrok Parsers
JavaComplex to parse, high volumeJava Parsers

 

Each parser outputs a Metron JSON formatted message.  The reason why JSON was chosen as a format for Metron is a very flexible data structure that allows nesting and lists.  We do not dictate what the JSON structure should look like, however, Metron is looking for specific normalized fields in order to do downstream processing.