请求编写Jolt转换规则：根据TimeResolved值调整severity字段

转换规则 #

以下Jolt规则可满足需求，通过shift操作结合条件匹配实现逻辑：

[
  {
    "operation": "shift",
    "spec": {
      "parameterid": "parameterid",
      "TimeResolved": {
        "null": {
          "@2,severity": "severity",
          "#null": "TimeResolved"
        },
        "*": {
          "#0": "severity",
          "#null": "TimeResolved"
        }
      }
    }
  }
]

规则说明 #

• 保留parameterid字段原值；
• 对TimeResolved字段做分支判断：
  • 当TimeResolved为null时，保留原始severity值，同时将TimeResolved设为null；
  • 当TimeResolved为非null值时，将severity强制设为0，TimeResolved设为null。

测试案例 #

案例1：TimeResolved为null的输入

{
  "parameterid": "Testing rule for event ID_Testing 1.0",
  "severity": 2,
  "TimeResolved": null
}

输出：

{
  "parameterid": "Testing rule for event ID_Testing 1.0",
  "severity": 2,
  "TimeResolved": null
}

案例2：TimeResolved为非null的输入

{
  "parameterid": "Testing rule for event ID_Testing 1.0",
  "severity": 2,
  "TimeResolved": 123456
}

输出：

{
  "parameterid": "Testing rule for event ID_Testing 1.0",
  "severity": 0,
  "TimeResolved": null
}

内容的提问来源于stack exchange，提问作者priyanka