Feature request: modify arbitrary fields

[johnhtodd]

Is your feature request related to a problem? Please describe.
It would be useful to minimize certain kinds of data transmitted by deleting fields. There are also instances where modifying data to minimize cardinality would be useful. This type of deletion or modification would save on backhaul, and also would be useful in certain ways for privacy (such as deleting client IP address data by setting that field to "", even though there is another feature request open to do that in a different way)

Describe the solution you'd like
A transformation that allows arbitrary modification of fields would be the ideal method.

Describe alternatives you've considered
It's not clear that there is any other method to do this currently.

Additional context
Here's what I would imagine this would look like in the configuration file to blank out the DNSTAP version string, and to change the identity string to an arbitrary value of "pdx" (which is one of our POP codes, instead of the specific hostname):

  transforms:
   rewrite:
     dnstap.version: ""
     dnstap.identity: "pdx"

Re-writing RR's or anything that is in an unpredictable array would be very difficult - I haven't thought about that in depth, but maybe that's just not something that is easily (or ever) done in a way that is predictable, other than deleting/nulling data. Field definitions would have to be kept in some way (true/false, numeric, string, etc.) or errors produced on insertion of invalid data into the message.

[dmachard]

It will be implemented in the future first stable release.

[dmachard]

implemented in the first stable release