fluent-plugin-parser-winevt_xml 0.2.7 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 57f851a356d136b50d477e76df4561e38247128582670da814e9969939683dfe
-  data.tar.gz: 806c98067fca378bb3fee19b3abcb80e768c0880a982c7a03e0f9262a1a7cd32
+  metadata.gz: 3da55ba29ddc8b7c6c0a9e76525ecbe15775e5d682dd7448b329a50715f49c7a
+  data.tar.gz: 8a4f47f6b7c1bdc10822eab7cf35751f25c67ba6b156568b49c11f2616ea7644
 SHA512:
-  metadata.gz: 0b212dce92cf31f0d0b2bfad75a574ea3465d92fd13798eba9dfdac5acd9e46a6bf4ff3c8cc4c5ed2ee58abbe7f85e8b42e765f0351709dfdd211560be5f9486
-  data.tar.gz: eacb700f750999d5fa2fbdfb43ec205b63edc2c45078bbb9cdc6e3365a559c2dbc0aa5af2adb320c6cfe15a8dfc172d9679ad5a03202544ad30d511c46d895af
+  metadata.gz: a81f1049873ed70f491fe6373ba666d3e0e76d883f49936ce585015089697784e6d95797a9052dde46b20a219b5146c8230417ce181fdd3255dd6005104ac55e
+  data.tar.gz: f5aeaba0d414bbc15206f4055f3685e6a49ba781f156e226a523abd560b59e79c4e1eaddb70299e370e0b6ad86c55020f244d26a6ca8fe00d6b5c0f525e87ed7

data/.github/dependabot.yml

@@ -3,4 +3,21 @@ updates:
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
-      interval: 'weekly'
+      interval: 'monthly'
+    groups:
+      # PR: "Security update [package] from [old] to [new]"
+      # This PR should be merged in hurry
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - '*'
+
+      # PR: "Bump [package] from [old] to [new]"
+      # No need to be merged this PR in hurry. It is enough to merge
+      # once in a month.
+      monthly-updates:
+        applies-to: version-updates
+        patterns:
+          - '*'
+    # Allow to create PR both of security and normal updates.
+    open-pull-requests-limit: 1

data/.github/workflows/linux-test.yaml

@@ -5,27 +5,32 @@ on:
     branches: [master]
   pull_request:
     branches: [master]
+  schedule:
+    - cron: '0 0 1 * *'
 
 jobs:
+  ruby-versions:
+    uses: ruby/actions/.github/workflows/ruby_versions.yml@master
+    with:
+      engine: cruby
+      min_version: 3.2
   test:
+    needs: ruby-versions
     runs-on: ${{ matrix.os }}
-    continue-on-error: ${{ matrix.experimental }}
+    continue-on-error: ${{ matrix.ruby == 'head' }}
     strategy:
       fail-fast: false
       matrix:
-        ruby: ['3.3', '3.2', '3.1', '3.0', '2.7']
+        ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }}
+        exclude:
+          - ruby: ${{ github.event_name != 'schedule' && 'head' || '__none__' }}
         os: [ubuntu-latest]
-        experimental: [false]
-        include:
-          - ruby: head
-            os: ubuntu-latest
-            experimental: true
 
     name: Ruby ${{ matrix.ruby }} on ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
         with:
           ruby-version: ${{ matrix.ruby }}
       - name: Install dependencies

data/.github/workflows/macos-test.yaml

@@ -5,21 +5,31 @@ on:
     branches: [master]
   pull_request:
     branches: [master]
+  schedule:
+    - cron: '0 0 1 * *'
 
 jobs:
+  ruby-versions:
+    uses: ruby/actions/.github/workflows/ruby_versions.yml@master
+    with:
+      engine: cruby
+      min_version: 3.2
   test:
+    needs: ruby-versions
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        ruby: ['3.3', '3.2', '3.1', '3.0', '2.7']
+        ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }}
+        exclude:
+          - ruby: ${{ github.event_name != 'schedule' && 'head' || '__none__' }}
         os: [macos-latest]
 
     name: Ruby ${{ matrix.ruby }} on ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
         with:
           ruby-version: ${{ matrix.ruby }}
       - name: Install dependencies

data/.github/workflows/windows-test.yaml

@@ -5,21 +5,31 @@ on:
     branches: [master]
   pull_request:
     branches: [master]
+  schedule:
+    - cron: '0 0 1 * *'
 
 jobs:
+  ruby-versions:
+    uses: ruby/actions/.github/workflows/ruby_versions.yml@master
+    with:
+      engine: cruby
+      min_version: 3.2
   test:
+    needs: ruby-versions
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        ruby: ['3.3', '3.2', '3.1', '3.0', '2.7']
+        ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }}
+        exclude:
+          - ruby: ${{ github.event_name != 'schedule' && 'head' || '__none__' }}
         os:
           - windows-latest
     name: Ruby ${{ matrix.ruby }} on ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
         with:
           ruby-version: ${{ matrix.ruby }}
       - name: Install dependencies

data/README.md

@@ -1,7 +1,8 @@
 # fluent-plugin-parser-winevt_xml
 
-[![Build status](https://ci.appveyor.com/api/projects/status/eb0capv0q70u381f/branch/master?svg=true)](https://ci.appveyor.com/project/fluent/fluent-plugin-parser-winevt-xml/branch/master)
-[![Build Status](https://travis-ci.org/fluent/fluent-plugin-parser-winevt_xml.svg?branch=master)](https://travis-ci.org/fluent/fluent-plugin-parser-winevt_xml)
+[![Test on macOS](https://github.com/fluent/fluent-plugin-parser-winevt_xml/actions/workflows/macos-test.yaml/badge.svg)](https://github.com/fluent/fluent-plugin-parser-winevt_xml/actions/workflows/macos-test.yaml)
+[![Test on Ubuntu](https://github.com/fluent/fluent-plugin-parser-winevt_xml/actions/workflows/linux-test.yaml/badge.svg)](https://github.com/fluent/fluent-plugin-parser-winevt_xml/actions/workflows/linux-test.yaml)
+[![Test on Windows](https://github.com/fluent/fluent-plugin-parser-winevt_xml/actions/workflows/windows-test.yaml/badge.svg)](https://github.com/fluent/fluent-plugin-parser-winevt_xml/actions/workflows/windows-test.yaml)
 
 ## Component
 

data/fluent-plugin-parser-winevt_xml.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "fluent-plugin-parser-winevt_xml"
-  spec.version       = "0.2.7"
+  spec.version       = "0.3.0"
   spec.authors       = ["Hiroshi Hatake", "Masahiro Nakagawa"]
   spec.email         = ["cosmo0920.oucc@gmail.com", "repeatedly@gmail.com"]
   spec.summary       = %q{Fluentd Parser plugin to parse XML rendered windows event log.}
@@ -20,8 +20,10 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake"
   spec.add_development_dependency "test-unit", "~> 3.4.0"
+  spec.add_development_dependency "nokogiri", ">= 1.12.5"
+
   spec.add_runtime_dependency "fluentd", [">= 0.14.12", "< 2"]
-  spec.add_runtime_dependency "nokogiri", [">= 1.12.5", "< 1.17"]
+  spec.add_runtime_dependency "rexml", "~> 3.2"
 
   # gems that aren't default gems as of Ruby 3.4
   spec.add_runtime_dependency "base64", "~> 0.2"

data/lib/fluent/plugin/parser_winevt_sax.rb

@@ -1,12 +1,38 @@
 require 'fluent/plugin/parser'
-require 'fluent/plugin/winevt_sax_document'
-require 'nokogiri'
 
 module Fluent::Plugin
   class WinevtSAXparser < Parser
     Fluent::Plugin.register_parser('winevt_sax', self)
 
     config_param :preserve_qualifiers, :bool, default: true
+    config_param :parser, :enum, list: [:auto, :rexml, :nokogiri], default: :auto
+
+    def initialize
+      super
+      @use_nokogiri = false
+    end
+
+    def configure(conf)
+      super
+      if @parser != :rexml
+        begin
+          require 'nokogiri'
+          require 'fluent/plugin/winevt_sax_document_nokogiri'
+          @use_nokogiri = true
+        rescue
+          if @parser == :nokogiri
+            raise Fluent::ConfigError,
+                  "Nokogiri is required when 'parser nokogiri' is specified, but it isn't installed. " \
+                  "Install nokogiri, or set 'parser' to 'rexml' or 'auto': #{e.message}"
+          end
+        end
+      end
+
+      if !@use_nokogiri
+        require 'rexml/parsers/sax2parser'
+        require 'fluent/plugin/winevt_sax_document_rexml'
+      end
+    end
 
     def winevt_xml?
       true
@@ -17,9 +43,16 @@ module Fluent::Plugin
     end
 
     def parse(text)
-      evtxml = WinevtXMLDocument.new(@preserve_qualifiers)
-      parser = Nokogiri::XML::SAX::Parser.new(evtxml)
-      parser.parse(text)
+      if @use_nokogiri
+        evtxml = WinevtXMLDocumentNokogiri.new(@preserve_qualifiers)
+        parser = Nokogiri::XML::SAX::Parser.new(evtxml)
+        parser.parse(text)
+      else
+        evtxml = WinevtXMLDocumentREXML.new(@preserve_qualifiers)
+        parser = REXML::Parsers::SAX2Parser.new(text)
+        parser.listen(evtxml)
+        parser.parse
+      end
       time = @estimate_current_event ? Fluent::EventTime.now : nil
       yield time, evtxml.result
     end

data/lib/fluent/plugin/parser_winevt_xml.rb

@@ -1,11 +1,36 @@
 require 'fluent/plugin/parser'
-require 'nokogiri'
 
 module Fluent::Plugin
   class WinevtXMLparser < Parser
     Fluent::Plugin.register_parser('winevt_xml', self)
 
     config_param :preserve_qualifiers, :bool, default: true
+    config_param :parser, :enum, list: [:auto, :rexml, :nokogiri], default: :auto
+
+    def initialize
+      super
+      @use_nokogiri = false
+    end
+
+    def configure(conf)
+      super
+      if @parser != :rexml
+        begin
+          require 'nokogiri'
+          @use_nokogiri = true
+        rescue
+          if @parser == :nokogiri
+            raise Fluent::ConfigError,
+                  "Nokogiri is required when 'parser nokogiri' is specified, but it isn't installed. " \
+                  "Install nokogiri, or set 'parser' to 'rexml' or 'auto': #{e.message}"
+          end
+        end
+      end
+
+      if !@use_nokogiri
+        require 'rexml/document'
+      end
+    end
 
     def winevt_xml?
       true
@@ -19,8 +44,10 @@ module Fluent::Plugin
       (low & 0xffff) | (high & 0xffff) << 16
     end
 
-    def event_id(system_elem)
-      return (system_elem/'EventID').text rescue nil if @preserve_qualifiers
+    def event_id_nokogiri(system_elem)
+      if @preserve_qualifiers
+        return ((system_elem/'EventID').text rescue nil)
+      end
 
       qualifiers = (system_elem/'EventID').attribute("Qualifiers").text rescue nil
       if qualifiers
@@ -32,16 +59,29 @@ module Fluent::Plugin
       end
     end
 
-    def parse(text)
+    def event_id_rexml(system_elem)
+      return system_elem.elements['EventID'].text rescue nil if @preserve_qualifiers
+
+      qualifiers = system_elem.elements['EventID'].attributes['Qualifiers'] rescue nil
+      if qualifiers
+        event_id = system_elem.elements['EventID'].text
+        event_id = MAKELONG(event_id.to_i, qualifiers.to_i)
+        event_id.to_s
+      else
+        system_elem.elements['EventID'].text rescue nil
+      end
+    end
+
+    def parse_nokogiri(text)
       record = {}
       doc = Nokogiri::XML(text)
       system_elem                     = doc/'Event'/'System'
       record["ProviderName"]          = (system_elem/"Provider").attribute("Name").text rescue nil
       record["ProviderGUID"]          = (system_elem/"Provider").attribute("Guid").text rescue nil
       if @preserve_qualifiers
-        record["Qualifiers"]            = (system_elem/'EventID').attribute("Qualifiers").text rescue nil
+        record["Qualifiers"]          = (system_elem/'EventID').attribute("Qualifiers").text rescue nil
       end
-      record["EventID"]               = event_id(system_elem)
+      record["EventID"]               = event_id_nokogiri(system_elem)
       record["Level"]                 = (system_elem/'Level').text rescue nil
       record["Task"]                  = (system_elem/'Task').text rescue nil
       record["Opcode"]                = (system_elem/'Opcode').text rescue nil
@@ -57,6 +97,43 @@ module Fluent::Plugin
       record["UserID"]                = (system_elem/'Security').attribute("UserID").text rescue nil
       record["Version"]               = (system_elem/'Version').text rescue nil
       time = @estimate_current_event ? Fluent::EventTime.now : nil
+      return time, record
+    end
+
+    def parse_rexml(text)
+      record = {}
+      doc = REXML::Document.new(text)
+      system_elem = doc.root.elements['System'] rescue nil
+      record["ProviderName"]      = system_elem.elements['Provider'].attributes['Name'] rescue nil
+      record["ProviderGUID"]      = system_elem.elements['Provider'].attributes['Guid'] rescue nil
+      if @preserve_qualifiers
+        record["Qualifiers"]      = system_elem.elements['EventID'].attributes['Qualifiers'] rescue nil
+      end
+      record["EventID"]           = event_id_rexml(system_elem)
+      record["Level"]             = system_elem.elements['Level'].text rescue nil
+      record["Task"]              = system_elem.elements['Task'].text rescue nil
+      record["Opcode"]            = system_elem.elements['Opcode'].text rescue nil
+      record["Keywords"]          = system_elem.elements['Keywords'].text rescue nil
+      record["TimeCreated"]       = system_elem.elements['TimeCreated'].attributes['SystemTime'] rescue nil
+      record["EventRecordID"]     = system_elem.elements['EventRecordID'].text rescue nil
+      record["ActivityID"]        = system_elem.elements['Correlation'].attributes['ActivityID'] rescue nil
+      record["RelatedActivityID"] = system_elem.elements['Correlation'].attributes['RelatedActivityID'] rescue nil
+      record["ThreadID"]          = system_elem.elements['Execution'].attributes['ThreadID'] rescue nil
+      record["ProcessID"]         = system_elem.elements['Execution'].attributes['ProcessID'] rescue nil
+      record["Channel"]           = system_elem.elements['Channel'].text rescue nil
+      record["Computer"]          = system_elem.elements['Computer'].text rescue nil
+      record["UserID"]            = system_elem.elements['Security'].attributes['UserID'] rescue nil
+      record["Version"]           = system_elem.elements['Version'].text rescue nil
+      time = @estimate_current_event ? Fluent::EventTime.now : nil
+      return time, record
+    end
+
+    def parse(text)
+      if @use_nokogiri
+        time, record = parse_nokogiri(text)
+      else
+        time, record = parse_rexml(text)
+      end
       yield time, record
     end
   end

data/lib/fluent/plugin/{winevt_sax_document.rb → winevt_sax_document_nokogiri.rb}

@@ -1,6 +1,6 @@
 require 'nokogiri'
 
-class WinevtXMLDocument < Nokogiri::XML::SAX::Document
+class WinevtXMLDocumentNokogiri < Nokogiri::XML::SAX::Document
   def initialize(preserve_qualifiers)
     @stack = []
     @result = {}
@@ -66,6 +66,7 @@ class WinevtXMLDocument < Nokogiri::XML::SAX::Document
   end
 
   def end_element(name, attributes = [])
+    @stack.pop
   end
 
   def end_document

data/lib/fluent/plugin/winevt_sax_document_rexml.rb

@@ -0,0 +1,98 @@
+require 'rexml/parsers/sax2parser'
+
+class WinevtXMLDocumentREXML
+  def initialize(preserve_qualifiers)
+    @stack = []
+    @result = {}
+    @preserve_qualifiers = preserve_qualifiers
+  end
+
+  def MAKELONG(low, high)
+    (low & 0xffff) | (high & 0xffff) << 16
+  end
+
+  def event_id
+    if @result.has_key?("Qualifiers")
+      qualifiers = @result.delete("Qualifiers")
+      event_id = @result['EventID']
+      event_id = MAKELONG(event_id.to_i, qualifiers.to_i)
+      @result['EventID'] = event_id.to_s
+    else
+      @result['EventID']
+    end
+  end
+
+  def result
+    return @result if @preserve_qualifiers
+
+    if @result
+      @result['EventID'] = event_id
+    end
+    @result
+  end
+
+  def start_element(*args)
+    # REXML SAX2 may pass (uri, localname, qname, attributes) or (qname, attributes)
+    name = if args.length >= 3
+             args[1].to_s
+           else
+             args[0].to_s
+           end
+    # normalize namespace/prefix
+    name = name.split('}').last if name.include?('}')
+    name = name.split(':').last if name.include?(':')
+    @stack << name
+
+    attrs = args.last || {}
+
+    # helper to fetch attribute value from different attribute containers
+    get_attr = lambda do |a, k|
+      begin
+        if a.is_a?(Array)
+          pair = a.find { |p| p && p[0] && p[0].to_s == k.to_s }
+          pair && pair[1]
+        elsif a.respond_to?(:[])
+          a[k] || a[k.to_sym]
+        else
+          nil
+        end
+      rescue
+        nil
+      end
+    end
+
+    if name == "Provider"
+      @result["ProviderName"] = get_attr.call(attrs, 'Name')
+      @result["ProviderGUID"] = get_attr.call(attrs, 'Guid')
+    elsif name == "EventID"
+      @result["Qualifiers"] = get_attr.call(attrs, 'Qualifiers')
+    elsif name == "TimeCreated"
+      @result["TimeCreated"] = get_attr.call(attrs, 'SystemTime')
+    elsif name == "Correlation"
+      @result["ActivityID"] = get_attr.call(attrs, 'ActivityID')
+      @result["RelatedActivityID"] = get_attr.call(attrs, 'RelatedActivityID')
+    elsif name == "Execution"
+      @result["ProcessID"] = get_attr.call(attrs, 'ProcessID')
+      @result["ThreadID"] = get_attr.call(attrs, 'ThreadID')
+    elsif name == "Security"
+      @result["UserID"] = get_attr.call(attrs, 'UserID')
+    end
+  end
+
+  def characters(string)
+    element = @stack.last
+    return unless element
+
+    if /^EventID|Level|Task|Opcode|Keywords|EventRecordID|ActivityID|Channel|Computer|Security|Version$/ === element
+      @result[element] = (@result[element] || '') + string
+    end
+  end
+
+  def end_element(*_)
+    @stack.pop
+  end
+
+  def method_missing(name, *args, &block)
+    # Ignore any SAX2 events we don't explicitly handle (e.g., progress)
+  end
+end

data/test/plugin/test_parser_winevt_sax.rb

@@ -2,43 +2,56 @@ require_relative '../helper'
 
 class WinevtSAXparserTest < Test::Unit::TestCase
 
-  def setup
-    Fluent::Test.setup
-  end
-
   CONFIG = %[]
-  XMLLOG = File.open(File.join(__dir__, "..", "data", "eventlog.xml") )
 
   def create_driver(conf = CONFIG)
     Fluent::Test::Driver::Parser.new(Fluent::Plugin::WinevtSAXparser).configure(conf)
   end
 
-  def test_parse
-    d = create_driver
-    xml = XMLLOG
-    expected = {"ProviderName"      => "Microsoft-Windows-Security-Auditing",
-                "ProviderGUID"      => "{54849625-5478-4994-A5BA-3E3B0328C30D}",
-                "EventID"           => "4624",
-                "Qualifiers"        => nil,
-                "Level"             => "0",
-                "Task"              => "12544",
-                "Opcode"            => "0",
-                "Keywords"          => "0x8020000000000000",
-                "TimeCreated"       => "2019-06-13T09:21:23.345889600Z",
-                "EventRecordID"     => "80688",
-                "ActivityID"        => "{587F0743-1F71-0006-5007-7F58711FD501}",
-                "RelatedActivityID" => nil,
-                "ProcessID"         => "912",
-                "ThreadID"          => "24708",
-                "Channel"           => "Security",
-                "Computer"          => "Fluentd-Developing-Windows",
-                "UserID"            => nil,
-                "Version"           => "2",}
-    d.instance.parse(xml) do |time, record|
-      assert_equal(expected, record)
+  class ParseTest < self
+    def setup
+      Fluent::Test.setup
+      @xml = File.open(File.join(__dir__, "..", "data", "eventlog.xml"))
+    end
+
+    def teardown
+      @xml.close
     end
 
-    assert_true(d.instance.winevt_xml?)
+    data(
+      "auto" => [%[parser auto], true],
+      "nokogiri" => [%[parser nokogiri], true],
+      "rexml" => [%[parser rexml], false]
+    )
+    def test_parse(data)
+      config, expected_use_nokogiri = data
+      d = create_driver(CONFIG + config)
+      @xml = File.open(File.join(__dir__, "..", "data", "eventlog.xml"))
+      expected = {"ProviderName"      => "Microsoft-Windows-Security-Auditing",
+                  "ProviderGUID"      => "{54849625-5478-4994-A5BA-3E3B0328C30D}",
+                  "EventID"           => "4624",
+                  "Qualifiers"        => nil,
+                  "Level"             => "0",
+                  "Task"              => "12544",
+                  "Opcode"            => "0",
+                  "Keywords"          => "0x8020000000000000",
+                  "TimeCreated"       => "2019-06-13T09:21:23.345889600Z",
+                  "EventRecordID"     => "80688",
+                  "ActivityID"        => "{587F0743-1F71-0006-5007-7F58711FD501}",
+                  "RelatedActivityID" => nil,
+                  "ProcessID"         => "912",
+                  "ThreadID"          => "24708",
+                  "Channel"           => "Security",
+                  "Computer"          => "Fluentd-Developing-Windows",
+                  "UserID"            => nil,
+                  "Version"           => "2",}
+      d.instance.parse(@xml) do |time, record|
+        assert_equal(expected, record)
+      end
+
+      assert_true(d.instance.winevt_xml?)
+      assert_equal(expected_use_nokogiri, d.instance.instance_variable_get(:@use_nokogiri))
+    end
   end
 
   class QualifiersTest < self
@@ -50,8 +63,14 @@ class WinevtSAXparserTest < Test::Unit::TestCase
       @xml.close
     end
 
-    def test_parse_without_qualifiers
-      d = create_driver CONFIG + %[preserve_qualifiers false]
+    data(
+      "auto" => [%[parser auto], true],
+      "nokogiri" => [%[parser nokogiri], true],
+      "rexml" => [%[parser rexml], false]
+    )
+    def test_parse_without_qualifiers(data)
+      config, expected_use_nokogiri = data
+      d = create_driver(CONFIG + config + %[\npreserve_qualifiers false])
       expected = {"ActivityID"        => nil,
                   "Channel"           => "Application",
                   "Computer"          => "DESKTOP-G457RDR",
@@ -74,6 +93,7 @@ class WinevtSAXparserTest < Test::Unit::TestCase
       end
 
       assert_true(d.instance.winevt_xml?)
+      assert_equal(expected_use_nokogiri, d.instance.instance_variable_get(:@use_nokogiri))
     end
   end
 end

data/test/plugin/test_parser_winevt_xml.rb

@@ -2,44 +2,56 @@ require_relative '../helper'
 
 class WinevtXMLparserTest < Test::Unit::TestCase
 
-  def setup
-    Fluent::Test.setup
-  end
-
   CONFIG = %[]
-  XMLLOG = File.open(File.join(__dir__, "..", "data", "eventlog.xml"))
 
   def create_driver(conf = CONFIG)
     Fluent::Test::Driver::Parser.new(Fluent::Plugin::WinevtXMLparser).configure(conf)
   end
 
-  def test_parse
-    d = create_driver
-    xml = XMLLOG
-    expected = {"ProviderName"      => "Microsoft-Windows-Security-Auditing",
-                "ProviderGUID"      => "{54849625-5478-4994-A5BA-3E3B0328C30D}",
-                "EventID"           => "4624",
-                "Qualifiers"        => nil,
-                "Level"             => "0",
-                "Task"              => "12544",
-                "Opcode"            => "0",
-                "Keywords"          => "0x8020000000000000",
-                "TimeCreated"       => "2019-06-13T09:21:23.345889600Z",
-                "EventRecordID"     => "80688",
-                "ActivityID"        => "{587F0743-1F71-0006-5007-7F58711FD501}",
-                "RelatedActivityID" => nil,
-                "ProcessID"         => "912",
-                "ThreadID"          => "24708",
-                "Channel"           => "Security",
-                "Computer"          => "Fluentd-Developing-Windows",
-                "UserID"            => nil,
-                "Version"           => "2",}
-    d.instance.parse(xml) do |time, record|
-      assert_equal(expected, record)
+  class ParseTest < self
+    def setup
+      Fluent::Test.setup
+      @xml = File.open(File.join(__dir__, "..", "data", "eventlog.xml"))
+    end
+
+    def teardown
+      @xml.close
     end
-    xml.close
 
-    assert_true(d.instance.winevt_xml?)
+    data(
+      "auto" => [%[parser auto], true],
+      "nokogiri" => [%[parser nokogiri], true],
+      "rexml" => [%[parser rexml], false]
+    )
+    def test_parse(data)
+      config, expected_use_nokogiri = data
+      d = create_driver(CONFIG + config)
+      @xml = File.open(File.join(__dir__, "..", "data", "eventlog.xml"))
+      expected = {"ProviderName"      => "Microsoft-Windows-Security-Auditing",
+                  "ProviderGUID"      => "{54849625-5478-4994-A5BA-3E3B0328C30D}",
+                  "EventID"           => "4624",
+                  "Qualifiers"        => nil,
+                  "Level"             => "0",
+                  "Task"              => "12544",
+                  "Opcode"            => "0",
+                  "Keywords"          => "0x8020000000000000",
+                  "TimeCreated"       => "2019-06-13T09:21:23.345889600Z",
+                  "EventRecordID"     => "80688",
+                  "ActivityID"        => "{587F0743-1F71-0006-5007-7F58711FD501}",
+                  "RelatedActivityID" => nil,
+                  "ProcessID"         => "912",
+                  "ThreadID"          => "24708",
+                  "Channel"           => "Security",
+                  "Computer"          => "Fluentd-Developing-Windows",
+                  "UserID"            => nil,
+                  "Version"           => "2",}
+      d.instance.parse(@xml) do |time, record|
+        assert_equal(expected, record)
+      end
+
+      assert_true(d.instance.winevt_xml?)
+      assert_equal(expected_use_nokogiri, d.instance.instance_variable_get(:@use_nokogiri))
+    end
   end
 
   class QualifiersTest < self
@@ -51,8 +63,14 @@ class WinevtXMLparserTest < Test::Unit::TestCase
       @xml.close
     end
 
-    def test_without_qualifiers
-      d = create_driver CONFIG + %[preserve_qualifiers false]
+    data(
+      "auto" => [%[parser auto], true],
+      "nokogiri" => [%[parser nokogiri], true],
+      "rexml" => [%[parser rexml], false]
+    )
+    def test_parse_without_qualifiers(data)
+      config, expected_use_nokogiri = data
+      d = create_driver(CONFIG + config + %[\npreserve_qualifiers false])
       expected = {"ActivityID"        => nil,
                   "Channel"           => "Application",
                   "Computer"          => "DESKTOP-G457RDR",
@@ -75,6 +93,7 @@ class WinevtXMLparserTest < Test::Unit::TestCase
       end
 
       assert_true(d.instance.winevt_xml?)
+      assert_equal(expected_use_nokogiri, d.instance.instance_variable_get(:@use_nokogiri))
     end
   end
 end

metadata

@@ -1,15 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-parser-winevt_xml
 version: !ruby/object:Gem::Version
-  version: 0.2.7
+  version: 0.3.0
 platform: ruby
 authors:
 - Hiroshi Hatake
 - Masahiro Nakagawa
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-03-07 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -53,6 +52,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 3.4.0
+- !ruby/object:Gem::Dependency
+  name: nokogiri
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.12.5
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.12.5
 - !ruby/object:Gem::Dependency
   name: fluentd
   requirement: !ruby/object:Gem::Requirement
@@ -74,25 +87,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2'
 - !ruby/object:Gem::Dependency
-  name: nokogiri
+  name: rexml
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.12.5
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.17'
+        version: '3.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.12.5
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.17'
+        version: '3.2'
 - !ruby/object:Gem::Dependency
   name: base64
   requirement: !ruby/object:Gem::Requirement
@@ -141,7 +148,8 @@ files:
 - fluent-plugin-parser-winevt_xml.gemspec
 - lib/fluent/plugin/parser_winevt_sax.rb
 - lib/fluent/plugin/parser_winevt_xml.rb
-- lib/fluent/plugin/winevt_sax_document.rb
+- lib/fluent/plugin/winevt_sax_document_nokogiri.rb
+- lib/fluent/plugin/winevt_sax_document_rexml.rb
 - test/data/eventlog-with-qualifiers.xml
 - test/data/eventlog.xml
 - test/helper.rb
@@ -151,7 +159,6 @@ homepage: https://github.com/fluent/fluent-plugin-parser-winevt_xml
 licenses:
 - Apache-2.0
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -166,8 +173,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.26
-signing_key:
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Fluentd Parser plugin to parse XML rendered windows event log.
 test_files: