flexciton-logstash-output-opsgenie 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: bde1d899898b78b0af27e898c6a07d8daf07e3ae84e97520a2b6fec854944b6f
+  data.tar.gz: dcb75c88e77ba0834b45ce94f564f709b0fa053e796fddbd5b7677c228c4e275
+SHA512:
+  metadata.gz: 0d2be0b3b8b10a208a46fbb4e09579a14812f31e75322d888a15e6d65a4d360ecf5c90a9697946123868df6c005fd7c16401a91850ecf7d6a610dfda35954d19
+  data.tar.gz: a9aa782d9ddf3e3685c5582c0a0bf474f2a8c5ecc56c8db3a91c930f79ecb1a016cba57e1bd44108a11aa7acad2c407a883e9a3f685de825220f94eee9978610

data/CHANGELOG.md

@@ -0,0 +1,43 @@
+## 3.0.0 (September 22, 2017)
+
+### logstash-output-opsgenie
+
+* Update plugin to work with Rest API.
+* Please visit the documentation for more information about the API: https://docs.opsgenie.com/docs/alert-api
+
+## 2.1.0 (June 13, 2017)
+
+### logstash-output-opsgenie
+
+* Rewrite event getter to make it compatible with Logstash 5.4.
+* Added proxy settings to the HTTP request.
+
+## 2.0.2 (April 11, 2016)
+
+### logstash-output-opsgenie
+
+* Convert alert details to hash.
+
+## 2.0.1 (March 31, 2016)
+
+### logstash-output-opsgenie
+
+* Alert details field bug fix.
+
+## 2.0.0 (February 23, 2016)
+
+### logstash-output-opsgenie
+
+* Change Logstash core dependency.
+
+## 1.0.0 (September 30, 2015)
+
+### logstash-output-opsgenie
+
+* Update Readme with OpsGenie Integration and plugin installation info.
+
+## 0.1.0 (September 29, 2015)
+
+### logstash-output-opsgenie
+
+* Initial public release.

data/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gemspec

data/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2012–2015 Elasticsearch <http://www.elastic.co>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

data/NOTICE.TXT

@@ -0,0 +1,5 @@
+Elasticsearch
+Copyright 2012-2015 Elasticsearch
+
+This product includes software developed by The Apache Software
+Foundation (http://www.apache.org/).

data/README.md

@@ -0,0 +1,56 @@
+# OpsGenie Logstash Plugin
+
+This is a plugin for [Logstash](https://github.com/elastic/logstash).
+
+It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.
+
+### Install and Run OpsGenie Output Plugin in Logstash
+
+OpsGenie Logstash Output plugin is available in [RubyGems.org](https://rubygems.org/gems/logstash-output-opsgenie)
+
+- `Logstash 5.4+`
+```sh
+bin/logstash-plugin install logstash-output-opsgenie
+```
+- `Other Versions`
+```sh
+bin/plugin install logstash-output-opsgenie
+```
+
+- OpsGenie has an integration with Logstash. To use the plugin you need to add a [Logstash Integration](https://app.opsgenie.com/integration?add=Logstash) in OpsGenie and obtain the API Key.
+
+- You may use plugins like [Mutate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html) to populate the fields which will be used in [logstash-output-opsgenie](https://github.com/opsgenie/logstash-output-opsgenie).
+```filter {
+  mutate{
+    add_field => {
+        "opsgenieAction" => "create"
+        "alias" => "neo123"
+        "description" => "Every alert needs a description"
+        "actions" => ["Restart", "AnExampleAction"]
+	"tags" => ["OverwriteQuietHours","Critical"]
+	"[details][prop1]"=> "val1"
+        "[details][prop2]" => "val2"
+        "entity" => "An example entity"
+        "priority" => "P4"
+	"source" => "custom source"
+	"user" => "custom user"
+	"note" => "alert is created"
+        }
+    }
+    ruby {
+ 	 code => "event.set('teams', [{'name' => 'Integration'}, {'name' => 'Platform'}])"
+    }
+}
+```
+
+- Add the following configuration to your configuration file and populate "apiKey" field with your Logstash Integration API Key
+```sh
+output {
+	opsgenie {
+		"apiKey" => "logstash_integration_api_key"
+	}
+}
+```
+- Run Logstash.
+
+For more information about OpsGenie Logstash Integration, please refer to [integration guide](https://docs.opsgenie.com/docs/logstash-integration).

data/lib/logstash/outputs/opsgenie.rb

@@ -0,0 +1,294 @@
+# encoding: utf-8
+require "logstash/outputs/base"
+require "logstash/namespace"
+require 'json'
+require "uri"
+require "net/http"
+require "net/https"
+
+
+HTTP_EXCEPTIONS = [
+  Errno::EINVAL,
+  Net::HTTPBadResponse,
+  Net::HTTPHeaderSyntaxError,
+]
+
+RETRYABLE_HTTP_EXCEPTIONS = [
+  OpenSSL::SSL::SSLError,
+  EOFError,
+  Timeout::Error,
+  Errno::ETIMEDOUT,
+  Errno::ECONNRESET,
+  Errno::ECONNREFUSED,
+  Net::ProtocolError,
+  SocketError,
+  EOFError
+]
+
+HTTP_EXCEPTION_RETRIES = 5
+
+# The OpsGenie output is used to Create, Close, Acknowledge Alerts and Add Note to alerts in OpsGenie.
+# For this output to work, your event must contain "opsgenieAction" field and you must configure apiKey field in configuration.
+# If opsgenieAction is "create", event must contain "message" field.
+# For other actions ("close", "acknowledge" or "note"), event must contain "alias" or "alertId" field.
+#
+# If your event have the following fields (If you use default field names).
+#
+# Example event:
+#
+# {
+#    "note" => "test note",
+#    "opsgenieAction" => "create",
+#    "teams" => ["teams"],
+#    "description" => "test description",
+#    "source" => "test source",
+#    "message" => "test message",
+#    "priority" => "P4",
+#    "tags" => ["tags"],
+#    "@timestamp" => 2017-09-15T13:32:00.747Z,
+#    "@version" => "1",
+#    "host" => "Neo's-MacBook-Pro.local",
+#    "alias" => "test-alias",
+#    "details" => {
+#    "prop2" => "val2",
+#    "prop1" => "val1"
+# },
+#    "actions" => ["actions"],
+#    "user" => "test user",
+#    "entity" => "test entity"
+# }
+#
+# An alert with following properties will be created.
+#
+#     {
+#       "message": "test message",
+#       "alias": "test alias",
+#       "teams": ["teams"],
+#       "description": "test description",
+#       "source": "test source",
+#       "note": "test note",
+#       "user": "test user",
+#       "priority": "P4",
+#       "tags": [
+#         "tags"
+#       ],
+#       "details": {
+#         "prop2": "val2",
+#         "prop1": "val1"
+#       },
+#       "actions": [
+#         "actions"
+#       ],
+#       "entity": "test entity",
+#     }
+#
+# Fields with prefix "Attribute" are the keys of the fields will be extracted from Logstash event.
+# For more information about the api requests and their contents,
+# please refer to Alert API("https://docs.opsgenie.com/docs/alert-api") support doc.
+
+class LogStash::Outputs::OpsGenie < LogStash::Outputs::Base
+
+  config_name "opsgenie"
+
+  # OpsGenie Logstash Integration API Key
+  config :apiKey, :validate => :string, :required => true
+
+  # Proxy settings
+  config :proxy_address, :validate => :string, :required => false
+  config :proxy_port, :validate => :number, :required => false
+
+
+  # Host of opsgenie api, normally you should not need to change this field.
+  config :opsGenieBaseUrl, :validate => :string, :required => false, :default => 'https://api.opsgenie.com/v2/alerts/'
+
+  # Url will be used to close alerts in OpsGenie
+  config :closeActionPath, :validate => :string, :required => false, :default =>'/close'
+
+  # Url will be used to acknowledge alerts in OpsGenie
+  config :acknowledgeActionPath, :validate => :string, :required => false, :default =>'/acknowledge'
+
+  # Url will be used to add notes to alerts in OpsGenie
+  config :noteActionPath, :validate => :string, :required => false, :default =>'/notes'
+
+  # The value of this field holds the name of the action will be executed in OpsGenie.
+  # This field must be in Event object. Should be one of "create", "close", "acknowledge" or "note". Other values will be discarded.
+  config :actionAttribute, :validate => :string, :required => false, :default => 'opsgenieAction'
+
+  # This value specifies the query parameter identifierType
+  config :identifierType, :validate => :string, :required => false, :default =>'id'
+
+  # This value will be set to eventual identifier according to event(id/alias).
+  config :identifier, :validate => :string, :required => false, :default =>''
+
+  # The value of this field holds the Id of the alert that actions will be executed.
+  # One of "alertId" or "alias" field must be in Event object, except from "create" action
+  config :alertIdAttribute, :validate => :string, :required => false, :default => 'alertId'
+
+  # The value of this field holds the alias of the alert that actions will be executed.
+  # One of "alertId" or "alias" field must be in Event object, except from "create" action
+  config :aliasAttribute, :validate => :string, :required => false, :default => 'alias'
+
+  # The value of this field holds the alert text.
+  config :messageAttribute, :validate => :string, :required => false, :default => 'message'
+
+  # The value of this field holds the list of team names which will be responsible for the alert.
+  config :teamsAttribute, :validate => :string, :required => false, :default => 'teams'
+
+  # The value of this field holds the Teams and users that the alert will become
+  # visible to without sending any notification.
+  config :visibleToAttribute, :validate => :string, :required => false, :default => 'visibleTo'
+
+  # The value of this field holds the detailed description of the alert.
+  config :descriptionAttribute, :validate => :string, :required => false, :default => 'description'
+
+  # The value of this field holds the comma separated list of actions that can be executed on the alert.
+  config :actionsAttribute, :validate => :string, :required => false, :default => 'actions'
+
+  # The value of this field holds the source of alert. By default, it will be assigned to IP address of incoming request.
+  config :sourceAttribute, :validate => :string, :required => false, :default => 'source'
+
+  # The value of this field holds the priority level of the alert
+  config :priorityAttribute, :validate => :string, :required => false, :default => 'priority'
+
+  # The value of this field holds the comma separated list of labels attached to the alert.
+  config :tagsAttribute, :validate => :string, :required => false, :default => 'tags'
+
+  # The value of this field holds the set of user defined properties. This will be specified as a nested JSON map
+  config :detailsAttribute, :validate => :string, :required => false, :default => 'details'
+
+  # The value of this field holds the entity the alert is related to.
+  config :entityAttribute, :validate => :string, :required => false, :default => 'entity'
+
+  # The value of this field holds the default owner of the execution. If user is not specified, owner of account will be used.
+  config :userAttribute, :validate => :string, :required => false, :default => 'user'
+
+  # The value of this field holds the additional alert note.
+  config :noteAttribute, :validate => :string, :required => false, :default => 'note'
+
+
+  public
+  def register
+  end # def register
+
+  public
+  def populateAliasOrId(event, params)
+    alertAlias = event.get(@aliasAttribute) if event.get(@aliasAttribute)
+    if alertAlias == nil then
+      alertId = event.get(@alertIdAttribute) if event.get(@alertIdAttribute)
+      if !(alertId == nil) then
+        @identifierType = 'id'
+        @identifier = alertId
+      end
+    else
+      @identifierType = 'alias'
+      @identifier = alertAlias
+    end
+  end # def populateAliasOrId
+
+  public
+  def executePost(uri, params)
+    unless uri == nil then
+      @logger.info("Executing url #{uri}")
+      url = URI(uri)
+      http = Net::HTTP.new(url.host, url.port, @proxy_address, @proxy_port)
+      if url.scheme == 'https'
+        http.use_ssl = true
+        http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+      end
+
+      retryCount = 0
+      begin
+        request = Net::HTTP::Post.new(
+          url.request_uri,
+          initheader = { "Content-Type" =>"application/json", "Authorization" => "GenieKey #{@apiKey}" }
+        )
+        request.body = params.to_json
+        response = http.request(request)
+      rescue *HTTP_EXCEPTIONS => e
+        @logger.warn("Silencing exception in logstash opsgenie outputs: [#{e.class}: #{e.message}]")
+        return
+      rescue *RETRYABLE_HTTP_EXCEPTIONS => e
+        if retryCount < HTTP_EXCEPTION_RETRIES
+          retryCount += 1
+          @logger.warn("Caught #{e.class}: #{e.message} - Retrying...")
+          exponentialBackoff(retryCount)
+          retry
+        else
+          @logger.warn(
+            "Silencing exception in logstash opsgenie outputs after #{HTTP_EXCEPTION_RETRIES} retries: [#{e.class}: #{e.message}]"
+          )
+          return
+        end
+      end
+
+      body = response.body
+      body = JSON.parse(body)
+      @logger.warn("Executed [#{uri}]. Response:[#{body}]")
+    end
+  end # def executePost
+
+  public
+  def receive(event)
+    return unless output?(event)
+
+    @logger.info("processing #{event}")
+    opsGenieAction = event.get(@actionAttribute) if event.get(@actionAttribute)
+    if opsGenieAction then
+      params = {}
+      populateCommonContent(params, event)
+
+      case opsGenieAction.downcase
+      when "create"
+        uri = "#{@opsGenieBaseUrl}"
+        params = populateCreateAlertContent(params, event)
+      when "close"
+        uri = "#{@opsGenieBaseUrl}#{@identifier}#{@closeActionPath}?identifierType=#{@identifierType}"
+      when "acknowledge"
+        uri = "#{@opsGenieBaseUrl}#{@identifier}#{@acknowledgeActionPath}?identifierType=#{@identifierType}"
+      when "note"
+        uri = "#{@opsGenieBaseUrl}#{@identifier}#{@noteActionPath}?identifierType=#{@identifierType}"
+      else
+        @logger.warn("Action #{opsGenieAction} does not match any available action, discarding..")
+          return
+      end
+
+      executePost(uri, params)
+    else
+      @logger.warn("No opsgenie action defined")
+      return
+    end
+  end # def receive
+
+  private
+  def populateCreateAlertContent(params, event)
+    params['message'] = event.get(@messageAttribute) if event.get(@messageAttribute)
+    params['alias'] = event.get(@aliasAttribute) if event.get(@aliasAttribute)
+    params['teams'] = event.get(@teamsAttribute) if event.get(@teamsAttribute)
+    params['visibleTo'] = event.get(@visibleToAttribute) if event.get(@visibleToAttribute)
+    params['description'] = event.get(@descriptionAttribute) if event.get(@descriptionAttribute)
+    params['actions'] = event.get(@actionsAttribute) if event.get(@actionsAttribute)
+    params['tags'] = event.get(@tagsAttribute) if event.get(@tagsAttribute)
+    params['entity'] = event.get(@entityAttribute) if event.get(@entityAttribute)
+    params['priority'] = event.get(@priorityAttribute) if event.get(@priorityAttribute)
+    params['details'] = event.get(@detailsAttribute) if event.get(@detailsAttribute)
+
+
+    return params
+  end
+
+  private
+  def populateCommonContent(params, event)
+    populateAliasOrId(event, params)
+    params['source'] = event.get(@sourceAttribute) if event.get(@sourceAttribute)
+    params['user'] = event.get(@userAttribute) if event.get(@userAttribute)
+    params['note'] = event.get(@noteAttribute) if event.get(@noteAttribute)
+  end
+
+  private
+  def exponentialBackoff(retryCount)
+    nap = (2**retryCount - 1) / 2
+    @logger.info("sleeping for #{'%.2f' % nap} seconds")
+    sleep nap
+  end
+
+end # class LogStash::Outputs::OpsGenie

data/logstash-output-opsgenie.gemspec

@@ -0,0 +1,24 @@
+Gem::Specification.new do |s|
+  s.name = 'flexciton-logstash-output-opsgenie'
+  s.version         = '1.0.0'
+  s.licenses = ["Apache License (2.0)"]
+  s.summary = "This output Creates, Closes, Acknowledges alerts and Adds Note to alerts in OpsGenie."
+  s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
+  s.authors = ["Elastic"]
+  s.email = "info@elastic.co"
+  s.homepage = "http://www.elastic.co/guide/en/logstash/current/index.html"
+  s.require_paths = ["lib"]
+
+  # Files
+  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
+   # Tests
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "output" }
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
+  s.add_runtime_dependency "logstash-codec-plain"
+  s.add_development_dependency "logstash-devutils"
+end

data/spec/outputs/opsgenie_spec.rb

@@ -0,0 +1,52 @@
+require "logstash/devutils/rspec/spec_helper"
+require "logstash/outputs/opsgenie"
+require "logstash/codecs/plain"
+require "logstash/event"
+
+describe LogStash::Outputs::OpsGenie do
+
+  subject {LogStash::Outputs::OpsGenie.new( "apiKey" => "my_api_key" )}
+  let(:logger) { subject.logger}
+
+  describe "receive message" do
+
+    it "when opsgenieAction is not specified" do
+      expect(logger).to receive(:warn).with("No opsgenie action defined").once
+      subject.receive({"message" => "test_alert","@version" => "1","@timestamp" => "2015-09-22T11:20:00.250Z"})
+    end
+
+    it "when opsgenieAction is not valid" do
+      action = "invalid"
+      expect(logger).to receive(:warn).with("Action #{action} does not match any available action, discarding..").once
+      subject.receive({"message" => "test_alert","@version" => "1","@timestamp" => "2015-09-22T11:20:00.250Z", "opsgenieAction" => action})
+    end
+
+    it "when opsGenieAction is 'create'" do
+      event = {"message" => "test_alert", "@version" => "1", "@timestamp" => "2015-09-22T11:20:00.250Z", "opsgenieAction" => "create"}
+      expect(logger).to receive(:info).with("processing #{event}").once
+      expect(logger).to receive(:info).with("Executing url #{subject.opsGenieBaseUrl}#{subject.createActionUrl}").once
+      subject.receive(event)
+    end
+
+    it "when opsGenieAction is 'close'" do
+      event = {"message" => "test_alert", "@version" => "1", "@timestamp" => "2015-09-22T11:20:00.250Z", "opsgenieAction" => "close"}
+      expect(logger).to receive(:info).with("processing #{event}").once
+      expect(logger).to receive(:info).with("Executing url #{subject.opsGenieBaseUrl}#{subject.closeActionUrl}").once
+      subject.receive(event)
+    end
+
+    it "when opsGenieAction is 'acknowledge'" do
+      event = {"message" => "test_alert", "@version" => "1", "@timestamp" => "2015-09-22T11:20:00.250Z", "opsgenieAction" => "acknowledge"}
+      expect(logger).to receive(:info).with("processing #{event}").once
+      expect(logger).to receive(:info).with("Executing url #{subject.opsGenieBaseUrl}#{subject.acknowledgeActionUrl}").once
+      subject.receive(event)
+    end
+
+    it "when opsGenieAction is 'note'" do
+      event = {"message" => "test_alert", "@version" => "1", "@timestamp" => "2015-09-22T11:20:00.250Z", "opsgenieAction" => "note"}
+      expect(logger).to receive(:info).with("processing #{event}").once
+      expect(logger).to receive(:info).with("Executing url #{subject.opsGenieBaseUrl}#{subject.noteActionUrl}").once
+      subject.receive(event)
+    end
+  end
+end

metadata

@@ -0,0 +1,104 @@
+--- !ruby/object:Gem::Specification
+name: flexciton-logstash-output-opsgenie
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Elastic
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2022-11-01 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.60'
+    - - "<="
+      - !ruby/object:Gem::Version
+        version: '2.99'
+  name: logstash-core-plugin-api
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.60'
+    - - "<="
+      - !ruby/object:Gem::Version
+        version: '2.99'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  name: logstash-codec-plain
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  name: logstash-devutils
+  prerelease: false
+  type: :development
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: This gem is a logstash plugin required to be installed on top of the
+  Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
+  gem is not a stand-alone program
+email: info@elastic.co
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- Gemfile
+- LICENSE
+- NOTICE.TXT
+- README.md
+- lib/logstash/outputs/opsgenie.rb
+- logstash-output-opsgenie.gemspec
+- spec/outputs/opsgenie_spec.rb
+homepage: http://www.elastic.co/guide/en/logstash/current/index.html
+licenses:
+- Apache License (2.0)
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: output
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.3.24
+signing_key:
+specification_version: 4
+summary: This output Creates, Closes, Acknowledges alerts and Adds Note to alerts
+  in OpsGenie.
+test_files:
+- spec/outputs/opsgenie_spec.rb