SPL, new generation compiler, intro
Not only does define ETL with multiple patterns to multiple tables, but
it also defines the searchability, aggregation, labels along with almost
every aspect of the user interfaces for dashboards, thresholds and graphs.
SPL is based on dividing logs into logical namespaces, parsing them into
tables using icons (which define what type of pattern should be used;
list, aligned, name-value-pair, or the latest additions xml and json).
As an example to classic ETL parsing of CSV [Comma Separated Value] --
which is merely a simple case of using list icon.
Another exciting change to Glassbeam SPL is, that it's changing from ETL
Loading occurs first, THEN transformation -- while Transformation still
can occur first, it can also occur "last"
- logs can be captured first, and then parsed -- particularly useful,
when parsing streams of data, e.g. syslog protocol, or SNMP
- the stored logs can be re-parsed with ease if additional parsing rules
are defined, thus avoiding the classic reload
With SPL it is possible to extract a reasonable ontology, which can then
be used for:
- semantic mapping for cluster analysis
- facets for full text searches