Event Fields mapping

When an event is ingested into Imperum, its attributes are mapped using a process that considers two layers of mapping:

1. Type Specific Mapping: This defines how fields in the event should be mapped based on the event's type.
2. Data Source Specific Mapping: This defines how fields should be mapped based on where the event is coming from.

How the Merging Works

Imperum first looks up both the type mapping and the data source mapping objects. It then merges these two mappings to generate a full mapping for the event. If they both specify a different way to map the same field, the type mapping will take precedence. This is because the type of the event is considered more specific, and therefore more important, than its data source.

Advantages of having two layers:

1. It may be configured custom mapping for each event type
2. No need to configure the same mapping for numerous event type as all event types can be handled by data source mapping