fluent-plugin-parser-winevt_xml 0.1.1 → 0.1.2
Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7411e3cffa23808b75834b504b3c72aef7d9d23ad2d39a26455b9e7ff5a3c3ae
|
|
4
|
+
data.tar.gz: 71cdf36beee23db60f832a6aad6544e06799df70e2863fd9eea5ce28ea653b69
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: bafcecd0c1e43f66fd96250a9f0c0268389534324091c1b67813bec7474d93f88b4c7869d6cada2ec79f1733c319d2a14d9fc9cc1089cb1b3324a75dc12126d6
|
|
7
|
+
data.tar.gz: ac0d44e0f2680dc364d377f94aca62b94e384441ab4c05b81f115b4963aecaf2baed8945725d21ac3b06d5bb166dcadf08c4ed0def8bf226779ac5603fdb47ad
|
|
@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
|
|
4
4
|
|
|
5
5
|
Gem::Specification.new do |spec|
|
|
6
6
|
spec.name = "fluent-plugin-parser-winevt_xml"
|
|
7
|
-
spec.version = "0.1.
|
|
7
|
+
spec.version = "0.1.2"
|
|
8
8
|
spec.authors = ["Hiroshi Hatake", "Masahiro Nakagawa"]
|
|
9
9
|
spec.email = ["cosmo0920.oucc@gmail.com", "repeatedly@gmail.com"]
|
|
10
10
|
spec.summary = %q{Fluentd Parser plugin to parse XML rendered windows event log.}
|
|
@@ -5,6 +5,10 @@ module Fluent::Plugin
|
|
|
5
5
|
class WinevtXMLparser < Parser
|
|
6
6
|
Fluent::Plugin.register_parser('winevt_xml', self)
|
|
7
7
|
|
|
8
|
+
def winevt_xml?
|
|
9
|
+
true
|
|
10
|
+
end
|
|
11
|
+
|
|
8
12
|
def parse(text)
|
|
9
13
|
record = {}
|
|
10
14
|
doc = Nokogiri::XML(text)
|
|
@@ -26,7 +30,6 @@ module Fluent::Plugin
|
|
|
26
30
|
record["Computer"] = (system_elem/"Computer").text rescue nil
|
|
27
31
|
record["UserID"] = (system_elem/'Security').attribute("UserID").text rescue nil
|
|
28
32
|
record["Version"] = (system_elem/'Version').text rescue nil
|
|
29
|
-
record["InsertStrings"] = [] # These parameters are processed in winevt_c.
|
|
30
33
|
time = @estimate_current_event ? Fluent::EventTime.now : nil
|
|
31
34
|
yield time, record
|
|
32
35
|
end
|
|
@@ -32,10 +32,11 @@ class WinevtXMLparserTest < Test::Unit::TestCase
|
|
|
32
32
|
"Channel" => "Security",
|
|
33
33
|
"Computer" => "Fluentd-Developing-Windows",
|
|
34
34
|
"UserID" => nil,
|
|
35
|
-
"Version" => "2",
|
|
36
|
-
"InsertStrings" => []}
|
|
35
|
+
"Version" => "2",}
|
|
37
36
|
d.instance.parse(xml) do |time, record|
|
|
38
37
|
assert_equal(expected, record)
|
|
39
38
|
end
|
|
39
|
+
|
|
40
|
+
assert_true(d.instance.winevt_xml?)
|
|
40
41
|
end
|
|
41
42
|
end
|