fluent-plugin-elastic-log 0.5.3 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2fb32147eab2de3f573ed8aca82b685b7c709036ec44e4f9d4f0051a3fd09ab2
-  data.tar.gz: d1468e6373e6ba82569e4f2a41aba725aab2f28d724171fc78e57f330d2298e6
+  metadata.gz: 2bf01058201e056f1f320acd85d647feb4c2b133d507889ab8bd88a5da8c487e
+  data.tar.gz: de25f2017972a6dc867034bd536dde0303afd09c5bee70cd816097f2834660e1
 SHA512:
-  metadata.gz: f7809d4b5832cfb4eb5d4dbb604ec725d64a975894fe098ae06b82844e0f4b61616156a84647920aa7d31ce6976a45fb1839262df3154e71f0d3b537e72fb77f
-  data.tar.gz: 52e1d72ba4d82497140779435c81ecc3f74ef8c449e31d9d2620b65af14929a5ec44cd0651de1e7e30e3a23e795a8cf256484b6e435649302cacaece87fcc179
+  metadata.gz: 8698830c34fc97b50210ed55b7f06d15b229184dbadd493f30d20fa495766a8442a6e25176b76456d9602e1df8af7e7893310c1c5a864011b293beb91b7b4b35
+  data.tar.gz: ddd74c90f196af2857420ae45ee4dcbc3645c3f54581998a1921d07b922dca75bcc034a3064a55efbfa9b15a0fc3ecae0c437d188ff37c4e437bafe63b569324

data/.rubocop.yml

@@ -1,10 +1,18 @@
-require:
+---
+
+plugins:
   - rubocop-rake
 
 AllCops:
-  TargetRubyVersion: 2.4
+  TargetRubyVersion: 2.7
   NewCops: enable
 
+Gemspec/DevelopmentDependencies:
+  EnforcedStyle: gemspec
+
+Metrics/AbcSize:
+  Max: 20
+
 Metrics/BlockLength:
   Exclude:
     - fluent-plugin-elastic-log.gemspec
@@ -24,3 +32,6 @@ Metrics/ParameterLists:
 Naming/MethodParameterName:
   Exclude:
     - lib/fluent/plugin/out_elastic_audit_log_metric.rb
+
+Style/Documentation:
+  Enabled: false

data/README.md

@@ -2,6 +2,7 @@
 
 [Fluentd](https://fluentd.org/) filter plugin to process elastic logs.
 
+
 ## plugins
 
 ### out - elastic_audit_log_metric
@@ -40,14 +41,39 @@ parameters for input record:
 
 parameters for output metric:
 * timestamp_format: Timestamp format (iso, epochmillis, epochmillis_str)
-* prefix: Attribute prefix for output metric
-* aggregate_index: Aggregate index (remove ilm suffix, wildcard suffix)
+* metadata_prefix: Metadata prefix for output metric
+
+parameters to aggregate metrics:
+* aggregate_index_clean_suffix: pattern to clean on index, to aggregate events
+* aggregate_interval: aggregate metrics by time interval, to reduce count of emitted events
 
 More details from the
 [elastic_audit_log_metric output plugin code](lib/fluent/plugin/out_elastic_audit_log_metric.rb#L49)
 
-## Installation
 
+produces metrics:
+
+| from category      | metric_name        | purpose                                             |
+|--------------------|--------------------|-----------------------------------------------------|
+| GRANTED_PRIVILEGES | user_query_count   | Query count made by users                           |
+| GRANTED_PRIVILEGES | index_query_count  | Query count made by index / index pattern with user |
+|--------------------|--------------------|-----------------------------------------------------|
+| FAILED_LOGIN       | failed_login_count | Count failed login by users without index           |
+
+
+Categories are :
+
+| Category           | Meaning                                                                         |
+|--------------------|---------------------------------------------------------------------------------|
+| FAILED_LOGIN       | Indicates unsuccessful authentication attempts (~ 401)                          |
+| MISSING_PRIVILEGES | Occurs when a user attempts an action without the necessary permissions (~ 403) |
+| BAD_HEADERS        | Triggered by requests containing malformed or invalid headers                   |
+| SSL_EXCEPTION      | Relates to issues with SSL/TLS connections, such as handshake failures.         |
+| AUTHENTICATED      | Records successful user authentications                                         |
+| GRANTED_PRIVILEGES | Logs instances where users are granted specific privileges                      |
+
+
+## Installation
 
 Manual install, by executing:
 
@@ -57,14 +83,18 @@ Add to Gemfile with:
 
     $ bundle add fluent-plugin-elastic-log
 
+
 ## Compatibility
 
 plugin in 1.x.x will work with:
-- ruby >= 2.4.10
-- td-agent >= 3.8.1-0
+- ruby >= 2.7.0
+- fluentd >= 1.8.0
+
+see [gemspec](fluent-plugin-elastic-log.gemspec).
+
 
 ## Copyright
 
-* Copyright(c) 2023- Thomas Tych
+* Copyright(c) 2023-2025 Thomas Tych
 * License
   * Apache License, Version 2.0

data/Rakefile

@@ -4,16 +4,23 @@ require 'bundler'
 Bundler::GemHelper.install_tasks
 
 require 'rake/testtask'
-require 'rubocop/rake_task'
-require 'bump/tasks'
 
 Rake::TestTask.new(:test) do |t|
   t.libs.push('lib', 'test')
-  t.test_files = FileList['test/**/test_*.rb', 'test/**/*_test.rb']
-  t.verbose = true
-  t.warning = true
+
+  t.test_files = if ENV['TEST_FILE']
+                   FileList["#{ENV['TEST_FILE']}*", "test/**/#{ENV['TEST_FILE']}*"]
+                 else
+                   FileList['test/**/test_*.rb', 'test/**/*_test.rb']
+                 end
+  t.verbose = ENV.fetch('VERBOSE', false)
+  t.warning = ENV.fetch('WARNING', false)
 end
 
+require 'rubocop/rake_task'
+
 RuboCop::RakeTask.new
 
+require 'bump/tasks'
+
 task default: %i[test rubocop]

data/fluent-plugin-elastic-log.gemspec

@@ -5,7 +5,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name    = 'fluent-plugin-elastic-log'
-  spec.version = '0.5.3'
+  spec.version = '1.0.0'
   spec.authors = ['Thomas Tych']
   spec.email   = ['thomas.tych@gmail.com']
 
@@ -13,7 +13,9 @@ Gem::Specification.new do |spec|
   spec.homepage      = 'https://gitlab.com/ttych/fluent-plugin-elastic-log'
   spec.license       = 'Apache-2.0'
 
-  spec.required_ruby_version = '>= 2.4.0'
+  spec.required_ruby_version = '>= 2.7.0'
+
+  spec.metadata['rubygems_mfa_required'] = 'true'
 
   spec.files = Dir.chdir(__dir__) do
     `git ls-files -z`.split("\x0").reject do |f|
@@ -23,20 +25,17 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  # commented dependency use blocked old versions
-  # for compatibility with ruby 2.4.10
-  # for old version of td-agent
-
-  spec.add_development_dependency 'bump', '~> 0.10.0'
-  spec.add_development_dependency 'bundler', '~> 2.2'
+  spec.add_development_dependency 'bump', '~> 0.10'
+  spec.add_development_dependency 'bundler', '~> 2.6', '>= 2.6.5'
   spec.add_development_dependency 'byebug', '~> 11.1', '>= 11.1.3'
-  spec.add_development_dependency 'rake', '~> 13.0.6'
-  spec.add_development_dependency 'reek', '~> 6.0.6' # < 6.1.x to work with ruby 2.4.10
-  spec.add_development_dependency 'rubocop', '~> 1.12.1' # < 1.13.x to work with ruby 2.4.10
-  spec.add_development_dependency 'rubocop-rake', '~> 0.5.1' # < 0.6.x to work with ruby 2.4.10
-  spec.add_development_dependency 'test-unit', '~> 3.5.7'
-
-  spec.add_runtime_dependency 'fluentd', ['>= 0.14.10', '< 2']
-
-  spec.metadata['rubygems_mfa_required'] = 'true'
+  spec.add_development_dependency 'mocha', '~> 2.7', '>= 2.7.1'
+  spec.add_development_dependency 'rake', '~> 13.2', '>= 13.2.1'
+  spec.add_development_dependency 'reek', '~> 6.4'
+  spec.add_development_dependency 'rubocop', '~> 1.73', '>= 1.73.1'
+  spec.add_development_dependency 'rubocop-rake', '~> 0.7', '>= 0.7.1'
+  spec.add_development_dependency 'simplecov', '~> 0.22'
+  spec.add_development_dependency 'test-unit', '~> 3.6', '>= 3.6.7'
+  spec.add_development_dependency 'timecop', '~> 0.9', '>= 0.9.10'
+
+  spec.add_dependency 'fluentd', ['>= 0.14.10', '< 2']
 end

data/lib/fluent/plugin/elastic_log/audit_log_to_metric_processor.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative 'metric_accumulator'
 require_relative 'granted_privileges_metric'
 require_relative 'failed_login_metric'
 
@@ -15,56 +16,38 @@ module Fluent
         end
 
         def process(_tag, log_es)
-          metric_es = []
+          metric_acc = new_metric_accumulator
 
-          log_es.each do |time, record|
+          log_es.each_value do |record|
             next unless record
             next unless (category = record[conf.category_key])
             next unless conf.categories.include? category
 
             new_records = send("generate_#{category.downcase}_metrics_for", record)
-            new_records&.each { |new_record| metric_es << [time, new_record] }
+            new_records&.each { |new_record| metric_acc << new_record }
           end
-          metric_es
+          metric_acc.to_a
         end
 
         private
 
-        # rubocop:disable Metrics/AbcSize
-        def generate_granted_privileges_metrics_for(record)
-          return [] unless record[conf.privilege_key]
+        def new_metric_accumulator
+          MetricAccumulator.new(value_key: 'metric_value')
+        end
 
+        def generate_granted_privileges_metrics_for(record)
           GrantedPrivilegesMetric.new(
-            record: {
-              timestamp: record[conf.timestamp_key],
-              privilege: record[conf.privilege_key],
-              user: record[conf.user_key],
-              cluster: record[conf.cluster_key],
-              indices: record[conf.indices_key],
-              r_indices: record[conf.r_indices_key],
-              layer: record[conf.layer_key],
-              request_type: record[conf.request_type_key]
-            },
-            conf: conf
+            conf: conf,
+            record: record
           ).generate_metrics
         end
-        # rubocop:enable Metrics/AbcSize
 
-        # rubocop:disable Metrics/AbcSize
         def generate_failed_login_metrics_for(record)
           FailedLoginMetric.new(
-            record: {
-              timestamp: record[conf.timestamp_key],
-              user: record[conf.user_key],
-              cluster: record[conf.cluster_key],
-              layer: record[conf.layer_key],
-              request_path: record[conf.rest_request_path_key],
-              request_body: record[conf.request_body_key]
-            },
-            conf: conf
+            conf: conf,
+            record: record
           ).generate_metrics
         end
-        # rubocop:enable Metrics/AbcSize
       end
     end
   end

data/lib/fluent/plugin/elastic_log/failed_login_metric.rb

@@ -10,8 +10,6 @@ module Fluent
       # record to metric converter
       #   for FAILED_LOGIN
       class FailedLoginMetric
-        attr_reader :record, :conf
-
         ELASTIC_URL_PATTERN = %r{(?:/(?<target>[^/]*))?/(?<action>_\w+)}.freeze
         QUERY_TYPE_MAP = {
           '_msearch' => 'msearch',
@@ -21,16 +19,43 @@ module Fluent
           '_search' => 'search'
         }.freeze
 
-        INDEX_PATTERN = /-?\*$/.freeze
-        ILM_PATTERN = /-\d{6}$/.freeze
+        attr_reader :record, :conf
 
         def initialize(record:, conf:)
           @record = record
           @conf = conf
         end
 
+        def record_timestamp
+          record[conf.timestamp_key]
+        end
+
+        def record_user
+          record[conf.user_key]
+        end
+
+        def record_cluster
+          record[conf.cluster_key]
+        end
+
+        def record_layer
+          record[conf.layer_key]
+        end
+
+        def record_request_path
+          record[conf.rest_request_path_key]
+        end
+
+        def record_request_body
+          record[conf.request_body_key]
+        end
+
         def timestamp
-          timestamp = Time.parse(record[:timestamp])
+          timestamp = Time.parse(record_timestamp)
+
+          if conf.aggregate_interval.to_i.positive?
+            timestamp = Time.at((timestamp.to_i / conf.aggregate_interval) * conf.aggregate_interval)
+          end
 
           return (timestamp.utc.to_f * 1000).to_i if conf.timestamp_format == :epochmillis
           return timestamp.utc.strftime('%s%3N') if conf.timestamp_format == :epochmillis_str
@@ -41,7 +66,7 @@ module Fluent
         end
 
         def query_details
-          if (match = ELASTIC_URL_PATTERN.match(record[:request_path]))
+          if (match = ELASTIC_URL_PATTERN.match(record_request_path))
             return [QUERY_TYPE_MAP.fetch(match[:action], 'other'),
                     match[:target]]
           end
@@ -53,13 +78,13 @@ module Fluent
             'timestamp' => timestamp,
             'metric_name' => 'failed_login_count',
             'metric_value' => 1,
-            "#{conf.prefix}user" => record[:user],
-            "#{conf.prefix}cluster" => record[:cluster]
+            "#{conf.metadata_prefix}user" => record_user,
+            "#{conf.metadata_prefix}cluster" => record_cluster
           }
         end
 
         def bulk_indices
-          req_body = record[:request_body] || {}
+          req_body = record_request_body || {}
           return [] if req_body.empty?
 
           req_body.each_line.each_slice(2).with_object(Set.new) do |(cmd_line, _data_line), acc|
@@ -69,7 +94,7 @@ module Fluent
         end
 
         def msearch_indices
-          req_body = record[:request_body] || {}
+          req_body = record_request_body || {}
           return [] if req_body.empty?
 
           req_body.each_line.each_slice(2).with_object(Set.new) do |(cmd_line, _data_line), acc|
@@ -80,25 +105,31 @@ module Fluent
         end
 
         def aggregate_index(index)
-          return unless index
-          return index unless conf.aggregate_index
+          return index unless index && conf.aggregate_index_clean_suffix
 
-          index.sub(INDEX_PATTERN, '').sub(ILM_PATTERN, '')
+          conf.aggregate_index_clean_suffix.inject(index) do |index_clean, clean_pattern|
+            index_clean.sub(clean_pattern, '')
+          end
         end
 
         def generate_metrics
-          query_action, query_index = query_details
-          indices = case query_action
-                    when 'bulk' then bulk_indices
-                    when 'msearch' then msearch_indices
-                    else []
-                    end
-          indices << aggregate_index(query_index) if query_index || indices.empty?
-
-          indices.inject([]) do |metrics, index|
-            metrics << base.merge("#{conf.prefix}index" => index,
-                                  "#{conf.prefix}query_type" => query_action)
-          end
+          metrics = []
+
+          query_action, = query_details
+
+          # indices = case query_action
+          #           when 'bulk' then bulk_indices
+          #           when 'msearch' then msearch_indices
+          #           else []
+          #           end
+          # indices << aggregate_index(query_index) if query_index || indices.empty?
+
+          # indices.inject([]) do |metrics, index|
+          #   metrics << base.merge("#{conf.metadata_prefix}index" => index,
+          #                         "#{conf.metadata_prefix}query_type" => query_action)
+          # end
+
+          metrics << base.merge("#{conf.metadata_prefix}query_type" => query_action)
         end
       end
     end

data/lib/fluent/plugin/elastic_log/granted_privileges_metric.rb

@@ -29,9 +29,6 @@ module Fluent
           'indices:monitor/' => 'monitor'
         }.freeze
 
-        INDEX_PATTERN = /-?\*$/.freeze
-        ILM_PATTERN = /-\d{6}$/.freeze
-
         attr_reader :record, :conf
 
         def initialize(record:, conf:)
@@ -39,8 +36,44 @@ module Fluent
           @conf = conf
         end
 
+        def record_timestamp
+          record[conf.timestamp_key]
+        end
+
+        def record_privilege
+          record[conf.privilege_key]
+        end
+
+        def record_user
+          record[conf.user_key]
+        end
+
+        def record_cluster
+          record[conf.cluster_key]
+        end
+
+        def record_indices
+          record[conf.indices_key]
+        end
+
+        def record_r_indices
+          record[conf.r_indices_key]
+        end
+
+        def record_layer
+          record[conf.layer_key]
+        end
+
+        def record_request_type
+          record[conf.request_type_key]
+        end
+
         def timestamp
-          timestamp = Time.parse(record[:timestamp])
+          timestamp = Time.parse(record_timestamp)
+
+          if conf.aggregate_interval.to_i.positive?
+            timestamp = Time.at((timestamp.to_i / conf.aggregate_interval) * conf.aggregate_interval)
+          end
 
           return (timestamp.utc.to_f * 1000).to_i if conf.timestamp_format == :epochmillis
           return timestamp.utc.strftime('%s%3N') if conf.timestamp_format == :epochmillis_str
@@ -52,7 +85,7 @@ module Fluent
 
         def query_type
           PRIVILEGE_MAP.each do |pattern, name|
-            return name if record[:privilege].to_s.start_with?(pattern)
+            return name if record_privilege.to_s.start_with?(pattern)
           end
           'unknown'
         end
@@ -60,37 +93,45 @@ module Fluent
         def base
           {
             'timestamp' => timestamp,
-            'metric_name' => 'query_count',
             'metric_value' => 1,
-            "#{conf.prefix}user" => record[:user],
-            "#{conf.prefix}cluster" => record[:cluster],
-            "#{conf.prefix}query_type" => query_type
+            "#{conf.metadata_prefix}user" => record_user,
+            "#{conf.metadata_prefix}cluster" => record_cluster,
+            "#{conf.metadata_prefix}query_type" => query_type
           }
         end
 
         def indices
-          indices = record[:r_indices] || record[:indices] || [nil]
-          if conf.aggregate_index
-            indices = indices.inject(Set.new) do |acc, index|
-              acc << aggregate_index(index)
-            end
+          indices = record_r_indices || record_indices || [nil]
+          indices.inject(Set.new) do |acc, index|
+            acc << aggregate_index(index)
           end
-          indices
         end
 
         def aggregate_index(index)
-          return unless index
-          return index unless conf.aggregate_index
+          return index unless index && conf.aggregate_index_clean_suffix
 
-          index.sub(INDEX_PATTERN, '').sub(ILM_PATTERN, '')
+          conf.aggregate_index_clean_suffix.inject(index) do |index_clean, clean_pattern|
+            index_clean.sub(clean_pattern, '')
+          end
         end
 
         def generate_metrics
-          metrics = []
-          indices.each do |index|
-            metrics << base.merge("#{conf.prefix}index" => index)
+          generate_user_metrics + generate_index_metrics
+        end
+
+        def generate_user_metrics
+          [
+            base.merge('metric_name' => 'user_query_count')
+          ]
+        end
+
+        def generate_index_metrics
+          indices.inject([]) do |metrics, index|
+            metrics << base.merge(
+              'metric_name' => 'index_query_count',
+              "#{conf.metadata_prefix}index" => index
+            )
           end
-          metrics
         end
       end
     end

data/lib/fluent/plugin/elastic_log/metric_accumulator.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Fluent
+  module Plugin
+    module ElasticLog
+      class MetricAccumulator
+        attr_reader :value_key
+
+        def initialize(value_key:)
+          @value_key = value_key
+
+          @data = []
+        end
+
+        def <<(metric)
+          @data << metric
+
+          self
+        end
+
+        def to_a
+          group.to_a
+        end
+
+        def group
+          grouped_data = @data.group_by { |metric| metric.reject { |k, _| k == value_key } }
+          grouped_data.map do |metric_base, metrics|
+            accumulated_value = metrics.sum { |metric| metric.fetch(value_key, 0) }
+            metric_base.update(
+              value_key => accumulated_value
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/fluent/plugin/out_elastic_audit_log_metric.rb

@@ -34,7 +34,9 @@ module Fluent
       ALLOWED_CATEGORIES = %w[GRANTED_PRIVILEGES FAILED_LOGIN].freeze
       # FAILED_LOGIN AUTHENTICATED MISSING_PRIVILEGES SSL_EXCEPTION
       # OPENDISTRO_SECURITY_INDEX_ATTEMPT BAD_HEADERS
+      DEFAULT_CATEGORIES = %w[GRANTED_PRIVILEGES].freeze
 
+      CONFIGURATION_KEYS = %w[category layer request_type cluster user indices r_indices timestamp privilege].freeze
       DEFAULT_CATEGORY_KEY = 'audit_category'
       DEFAULT_LAYER_KEY = 'audit_request_layer'
       DEFAULT_REQUEST_TYPE = 'audit_transport_request_type'
@@ -46,12 +48,16 @@ module Fluent
       DEFAULT_REQUEST_BODY = 'audit_request_body'
       DEFAULT_TIMESTAMP_KEY = '@timestamp'
       DEFAULT_PRIVILEGE_KEY = 'audit_request_privilege'
-      DEFAULT_PREFIX = ''
+
+      DEFAULT_AGGREGATE_INDEX_CLEAN_SUFFIX = [].freeze
+      DEFAULT_AGGREGATE_INTERVAL = nil
+
+      DEFAULT_METADATA_PREFIX = ''
 
       desc 'Tag to emit metric events on'
       config_param :tag, :string, default: nil
       desc 'Categories selected to be converted to metrics'
-      config_param :categories, :array, default: ALLOWED_CATEGORIES, value_type: :string
+      config_param :categories, :array, default: DEFAULT_CATEGORIES, value_type: :string
 
       desc 'Category key'
       config_param :category_key, :string, default: DEFAULT_CATEGORY_KEY
@@ -78,10 +84,17 @@ module Fluent
 
       desc 'Timestamp format'
       config_param :timestamp_format, :enum, list: %i[iso epochmillis epochmillis_str], default: :iso
-      desc 'Attribute prefix'
-      config_param :prefix, :string, default: DEFAULT_PREFIX
-      desc 'Aggregate index'
-      config_param :aggregate_index, :bool, default: true
+
+      desc 'Metadata prefix'
+      config_param :metadata_prefix, :string, default: DEFAULT_METADATA_PREFIX
+
+      desc 'Index suffix to clean, to aggregate_index'
+      config_param :aggregate_index_clean_suffix, :array, value_type: :regexp,
+                                                          default: DEFAULT_AGGREGATE_INDEX_CLEAN_SUFFIX
+
+      desc 'Aggregate interval, to aggregate metrics by time'
+      config_param :aggregate_interval, :integer, default: DEFAULT_AGGREGATE_INTERVAL
+
       desc 'Events block size'
       config_param :event_stream_size, :integer, default: 1000
 
@@ -105,7 +118,7 @@ module Fluent
       end
 
       def check_configuration_keys
-        keys = %w[category layer request_type cluster user indices r_indices timestamp privilege]
+        keys = CONFIGURATION_KEYS
         invalid_keys = keys.each_with_object([]) do |key, invalid|
           key_label = "#{key}_key"
           key_value = send(key_label)
@@ -115,11 +128,12 @@ module Fluent
         raise Fluent::ConfigError, "#{NAME}: #{invalid_keys} are empty" if invalid_keys.any?
       end
 
-      def process(_tag, es)
-        metrics = metric_processor.process(tag, es) || []
+      def process(es_tag, es)
+        time = Fluent::EventTime.now
+        metrics = metric_processor.process(es_tag, es) || []
         metrics.each_slice(event_stream_size) do |metrics_slice|
           metrics_es = MultiEventStream.new
-          metrics_slice.each { |time, record| metrics_es.add(time, record) }
+          metrics_slice.each { |record| metrics_es.add(time, record) }
           router.emit_stream(tag, metrics_es)
         end
       end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-elastic-log
 version: !ruby/object:Gem::Version
-  version: 0.5.3
+  version: 1.0.0
 platform: ruby
 authors:
 - Thomas Tych
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-06-27 00:00:00.000000000 Z
+date: 2025-03-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bump
@@ -16,28 +15,34 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.10.0
+        version: '0.10'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.10.0
+        version: '0.10'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.2'
+        version: '2.6'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.6.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.2'
+        version: '2.6'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.6.5
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -58,76 +63,154 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 11.1.3
+- !ruby/object:Gem::Dependency
+  name: mocha
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.7'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.7.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.7'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.7.1
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 13.0.6
+        version: '13.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 13.2.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 13.0.6
+        version: '13.2'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 13.2.1
 - !ruby/object:Gem::Dependency
   name: reek
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.0.6
+        version: '6.4'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.0.6
+        version: '6.4'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.12.1
+        version: '1.73'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.73.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.12.1
+        version: '1.73'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.73.1
 - !ruby/object:Gem::Dependency
   name: rubocop-rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.1
+        version: '0.7'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.7.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.1
+        version: '0.7'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.7.1
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.22'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.22'
 - !ruby/object:Gem::Dependency
   name: test-unit
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.5.7
+        version: '3.6'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.6.7
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.6'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.6.7
+- !ruby/object:Gem::Dependency
+  name: timecop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.9.10
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.5.7
+        version: '0.9'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.9.10
 - !ruby/object:Gem::Dependency
   name: fluentd
   requirement: !ruby/object:Gem::Requirement
@@ -148,7 +231,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '2'
-description:
 email:
 - thomas.tych@gmail.com
 executables: []
@@ -156,7 +238,6 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".rubocop.yml"
-- ".ruby-version"
 - Gemfile
 - LICENSE
 - README.md
@@ -165,13 +246,13 @@ files:
 - lib/fluent/plugin/elastic_log/audit_log_to_metric_processor.rb
 - lib/fluent/plugin/elastic_log/failed_login_metric.rb
 - lib/fluent/plugin/elastic_log/granted_privileges_metric.rb
+- lib/fluent/plugin/elastic_log/metric_accumulator.rb
 - lib/fluent/plugin/out_elastic_audit_log_metric.rb
 homepage: https://gitlab.com/ttych/fluent-plugin-elastic-log
 licenses:
 - Apache-2.0
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -179,15 +260,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.4.0
+      version: 2.7.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.11
-signing_key:
+rubygems_version: 3.6.5
 specification_version: 4
 summary: fluentd plugins to process elastic logs.'
 test_files: []

data/.ruby-version

@@ -1 +0,0 @@
-2.4.10