fluent-plugin-parser 0.1.0

data/.gitignore

@@ -0,0 +1,17 @@
+*.gem
+*.rbc
+.bundle
+.config
+.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in fluent-plugin-parser.gemspec
+gemspec

data/LICENSE

@@ -0,0 +1,22 @@
+Copyright (c) 2012 TAGOMORI Satoshi
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,77 @@
+# fluent-plugin-parser
+
+## Component
+
+### ParserOutput
+
+Parse string in log message, and re-emit.
+
+### DeparserOutput
+
+Generate string log value from log message, with specified format and fields, and re-emit.
+
+## Configuration
+
+### ParserOutput
+
+ParserOutput has just same with 'in_tail' about 'format' and 'time\_format':
+
+    <match raw.apache.common.*>
+      type parser
+      remove_prefix raw
+      format /^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)$/
+      time_format %d/%b/%Y:%H:%M:%S %z
+      key_name message
+    </match>
+
+Of course, you can use predefined format 'apache' and 'syslog':
+
+    <match raw.apache.combined.*>
+      type parser
+      remove_prefix raw
+      format apache
+      key_name message
+    </match>
+
+If you want original attribute-data pair in re-emitted message, specify 'reserve_data':
+
+    <match raw.apache.*>
+      type parser
+      tag apache
+      format apache
+      key_name message
+      reserve_data yes
+    </match>
+
+### DeparserOutput
+
+To build CSV from field 'store','item','num', as field 'csv', without raw data:
+
+    <match in.marketlog.**>
+      type deparser
+      remove_prefix in
+      format %s,%s,%s
+      format_key_names store,item,num
+      key_name csv
+    </match>
+
+To build same CSV, as additional field 'csv', with reserved raw fields:
+
+    <match in.marketlog>
+      type deparser
+      tag marketlog
+      format %s,%s,%s
+      format_key_names store,item,num
+      key_name csv
+      reserve_data yes
+    </match>
+
+## TODO
+
+* consider what to do next
+* patches welcome!
+
+## Copyright
+
+Copyright:: Copyright (c) 2012- TAGOMORI Satoshi (tagomoris)
+License::   Apache License, Version 2.0

data/Rakefile

@@ -0,0 +1,11 @@
+#!/usr/bin/env rake
+require "bundler/gem_tasks"
+
+require 'rake/testtask'
+Rake::TestTask.new(:test) do |test|
+  test.libs << 'lib' << 'test'
+  test.pattern = 'test/**/test_*.rb'
+  test.verbose = true
+end
+
+task :default => :test

data/fluent-plugin-parser.gemspec

@@ -0,0 +1,18 @@
+# -*- encoding: utf-8 -*-
+Gem::Specification.new do |gem|
+  gem.name          = "fluent-plugin-parser"
+  gem.version       = "0.1.0"
+  gem.authors       = ["TAGOMORI Satoshi"]
+  gem.email         = ["tagomoris@gmail.com"]
+  gem.description   = %q{fluentd plugin to parse single field, or to combine log structure into single field}
+  gem.summary       = %q{plugin to parse/combine fluentd log messages}
+  gem.homepage      = "https://github.com/tagomoris/fluent-plugin-parser"
+
+  gem.files         = `git ls-files`.split($\)
+  gem.executables   = gem.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
+  gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
+  gem.require_paths = ["lib"]
+
+  gem.add_development_dependency "fluentd"
+  gem.add_runtime_dependency "fluentd"
+end

data/lib/fluent/plugin/out_deparser.rb

@@ -0,0 +1,89 @@
+class Fluent::DeparserOutput < Fluent::Output
+  Fluent::Plugin.register_output('deparser', self)
+
+  config_param :tag, :string, :default => nil
+  config_param :remove_prefix, :string, :default => nil
+  config_param :add_prefix, :string, :default => nil
+  config_param :format, :string
+  config_param :format_key_names, :string
+  config_param :key_name, :string, :default => 'message'
+  config_param :reserve_data, :bool, :default => false
+
+  def april_fool_emit(tag, es, chain)
+    es.each {|time,record|
+      keys = record.keys.shuffle
+      new_record = {@key_name => keys.map{|k| record[k]}.join(' ')}
+      Fluent::Engine.emit(@tag, time, new_record)
+    }
+    chain.next
+  end
+
+  def configure(conf)
+    if conf['tag'] == 'april.fool'
+      conf['format'] = '%s'
+      conf['format_key_names'] = 'x'
+    end
+
+    super
+
+    if @tag == 'april.fool'
+      m = method(:april_fool_emit)
+      (class << self; self; end).module_eval do
+        define_method(:emit, m)
+      end
+      return
+    end
+
+    if not @tag and not @remove_prefix and not @add_prefix
+      raise Fluent::ConfigError, "missing both of remove_prefix and add_prefix"
+    end
+    if @tag and (@remove_prefix or @add_prefix)
+      raise Fluent::ConfigError, "both of tag and remove_prefix/add_prefix must not be specified"
+    end
+    if @remove_prefix
+      @removed_prefix_string = @remove_prefix + '.'
+      @removed_length = @removed_prefix_string.length
+    end
+    if @add_prefix
+      @added_prefix_string = @add_prefix + '.'
+    end
+
+    @format_key_names = @format_key_names.split(',')
+    begin
+      dummy = @format % (["x"] * @format_key_names.length)
+    rescue ArgumentError
+      raise Fluent::ConfigError, "mismatch between placeholder of format and format_key_names"
+    end
+  end
+
+  def emit(tag, es, chain)
+    tag = if @tag
+            @tag
+          else
+            if @remove_prefix and
+                ( (tag.start_with?(@removed_prefix_string) and tag.length > @removed_length) or tag == @remove_prefix)
+              tag = tag[@removed_length..-1]
+            end 
+            if @add_prefix 
+              tag = if tag and tag.length > 0
+                      @added_prefix_string + tag
+                    else
+                      @add_prefix
+                    end
+            end
+            tag
+          end
+    if @reserve_data
+      es.each {|time,record|
+        record.update({@key_name => (@format % @format_key_names.map{|k| record[k]})})
+        Fluent::Engine.emit(tag, time, record)
+      }
+    else
+      es.each {|time,record|
+        new_record = {@key_name => (@format % @format_key_names.map{|k| record[k]})}
+        Fluent::Engine.emit(tag, time, new_record)
+      }
+    end
+    chain.next
+  end
+end

data/lib/fluent/plugin/out_parser.rb

@@ -0,0 +1,97 @@
+class Fluent::ParserOutput < Fluent::Output
+  Fluent::Plugin.register_output('parser', self)
+
+  config_param :tag, :string, :default => nil
+  config_param :remove_prefix, :string, :default => nil
+  config_param :add_prefix, :string, :default => nil
+  config_param :key_name, :string
+  config_param :reserve_data, :bool, :default => false
+
+  def initialize
+    super
+    require 'time'
+  end
+
+  def configure(conf)
+    super
+
+    if not @tag and not @remove_prefix and not @add_prefix
+      raise Fluent::ConfigError, "missing both of remove_prefix and add_prefix"
+    end
+    if @tag and (@remove_prefix or @add_prefix)
+      raise Fluent::ConfigError, "both of tag and remove_prefix/add_prefix must not be specified"
+    end
+    if @remove_prefix
+      @removed_prefix_string = @remove_prefix + '.'
+      @removed_length = @removed_prefix_string.length
+    end
+    if @add_prefix
+      @added_prefix_string = @add_prefix + '.'
+    end
+
+    @parser = Fluent::TextParser.new
+    @parser.configure(conf)
+
+    m = if @parser.regexp.named_captures['time']
+          method(:parse_with_time)
+        else
+          method(:parse_without_time)
+        end
+    (class << self; self; end).module_eval do
+      define_method(:parse, m)
+    end
+  end
+
+  def parse_with_time(value)
+    @parser.parse(value)
+  end
+
+  def parse_without_time(value)
+    t,r = @parser.parse(value)
+    return [nil, r]
+  end
+
+  def emit(tag, es, chain)
+    tag = if @tag
+            @tag
+          else
+            if @remove_prefix and
+                ( (tag.start_with?(@removed_prefix_string) and tag.length > @removed_length) or tag == @remove_prefix)
+              tag = tag[@removed_length..-1]
+            end 
+            if @add_prefix 
+              tag = if tag and tag.length > 0
+                      @added_prefix_string + tag
+                    else
+                      @add_prefix
+                    end
+            end
+            tag
+          end
+    if @reserve_data
+      es.each {|time,record|
+        value = record[@key_name]
+        t,values = if value
+                     parse(value)
+                   else
+                     [nil, {}]
+                   end
+        t ||= time
+        record.update(values)
+        Fluent::Engine.emit(tag, t, record)
+      }
+    else
+      es.each {|time,record|
+        value = record[@key_name]
+        t,values = if value
+                     parse(value)
+                   else
+                     [nil, {}]
+                   end
+        t ||= time
+        Fluent::Engine.emit(tag, t, values)
+      }
+    end
+    chain.next
+  end
+end

data/test/helper.rb

@@ -0,0 +1,29 @@
+require 'rubygems'
+require 'bundler'
+begin
+  Bundler.setup(:default, :development)
+rescue Bundler::BundlerError => e
+  $stderr.puts e.message
+  $stderr.puts "Run `bundle install` to install missing gems"
+  exit e.status_code
+end
+require 'test/unit'
+
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+$LOAD_PATH.unshift(File.dirname(__FILE__))
+require 'fluent/test'
+unless ENV.has_key?('VERBOSE')
+  nulllogger = Object.new
+  nulllogger.instance_eval {|obj|
+    def method_missing(method, *args)
+      # pass
+    end
+  }
+  $log = nulllogger
+end
+
+require 'fluent/plugin/out_parser'
+require 'fluent/plugin/out_deparser'
+
+class Test::Unit::TestCase
+end

data/test/plugin/test_deparser.rb

@@ -0,0 +1,149 @@
+require 'helper'
+
+class DeparserOutputTest < Test::Unit::TestCase
+  def setup
+    Fluent::Test.setup
+  end
+  
+  CONFIG = %[
+    remove_prefix test
+    add_prefix    combined
+    format        %s: %s %s %s
+    format_key_names host,path,status,size
+    key_name      fulltext
+    reserve_data  true
+  ]
+
+  def create_driver(conf=CONFIG,tag='test')
+    Fluent::Test::OutputTestDriver.new(Fluent::DeparserOutput, tag).configure(conf)
+  end
+
+  def test_configure
+    assert_nothing_raised {
+      d = create_driver %[
+        tag april.fool
+      ]
+    }
+
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver('')
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        tag foo.bar
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        format %s
+        format_key_names x
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        tag foo.bar
+        remove_prefix foo
+        format %s
+        format_key_names x
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        tag foo.bar
+        add_prefix foo
+        format %s
+        format_key_names x
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        tag foo.bar
+        format_key_names x
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        tag foo.bar
+        format %s
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        tag foo.bar
+        format %s %s %s
+        format_key_names x,y
+      ]
+    }
+    assert_nothing_raised(Fluent::ConfigError) {
+      # mmm...
+      d = create_driver %[
+        tag foo.bar
+        format %s %s
+        format_key_names x,y,z
+      ]
+    }
+
+    d = create_driver %[
+      tag foo.bar
+      format %s: %s %s
+      format_key_names x,y,z
+    ]
+    assert_equal 'foo.bar', d.instance.tag
+    assert_equal '%s: %s %s', d.instance.format
+    assert_equal ['x','y','z'], d.instance.format_key_names
+    assert_equal 'message', d.instance.key_name
+    assert_equal false, d.instance.reserve_data
+  end
+
+  # CONFIG = %[
+  #   remove_prefix test
+  #   add_prefix    combined
+  #   format        %s: %s %s %s
+  #   format_key_names host path status size
+  #   key_name      fulltext
+  #   reserve_data  true
+  # ]
+  def test_emit
+    d1 = create_driver(CONFIG, 'test.in')
+    time = Time.parse("2012-01-02 13:14:15").to_i
+    d1.run do
+      d1.emit({'host'=>'xxx.local','path'=>'/f/1','status'=>'200','size'=>300}, time)
+      d1.emit({'host'=>'yyy.local','path'=>'/f/2','status'=>'302','size'=>512}, time)
+    end
+    emits = d1.emits
+    assert_equal 2, emits.length
+    first = emits[0]
+    assert_equal 'combined.in', first[0]
+    assert_equal time, first[1]
+    assert_equal 'xxx.local: /f/1 200 300', first[2]['fulltext']
+    assert_equal ['fulltext','host','path','size','status'], first[2].keys.sort
+    second = emits[1]
+    assert_equal 'combined.in', second[0]
+    assert_equal time, second[1]
+    assert_equal 'yyy.local: /f/2 302 512', second[2]['fulltext']
+    assert_equal ['fulltext','host','path','size','status'], second[2].keys.sort
+
+    d2 = create_driver(%[
+      tag combined
+      format %s: %s %s
+      format_key_names host,path,status
+    ], 'test.in')
+    time = Time.parse("2012-01-02 13:14:15").to_i
+    d2.run do
+      d2.emit({'host'=>'xxx.local','path'=>'/f/1','status'=>'200','size'=>300}, time)
+      d2.emit({'host'=>'yyy.local','path'=>'/f/2','status'=>'302','size'=>512}, time)
+    end
+    emits = d2.emits
+    assert_equal 2, emits.length
+    first = emits[0]
+    assert_equal 'combined', first[0]
+    assert_equal time, first[1]
+    assert_equal 'xxx.local: /f/1 200', first[2]['message']
+    assert_equal ['message'], first[2].keys.sort
+    second = emits[1]
+    assert_equal 'combined', second[0]
+    assert_equal time, second[1]
+    assert_equal 'yyy.local: /f/2 302', second[2]['message']
+    assert_equal ['message'], second[2].keys.sort
+  end
+end

data/test/plugin/test_out_parser.rb

@@ -0,0 +1,132 @@
+require 'helper'
+
+class ParserOutputTest < Test::Unit::TestCase
+  def setup
+    Fluent::Test.setup
+  end
+  
+  CONFIG = %[
+    remove_prefix test
+    add_prefix    parsed
+    key_name      message
+    format        /^(?<x>.)(?<y>.) (?<time>.+)$/
+    time_format   %Y%m%d%H%M%S
+    reserve_data  true
+  ]
+
+  def create_driver(conf=CONFIG,tag='test')
+    Fluent::Test::OutputTestDriver.new(Fluent::ParserOutput, tag).configure(conf)
+  end
+
+  def test_configure
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver('')
+    }
+    assert_nothing_raised {
+      d = create_driver %[
+        tag foo.bar
+        format /(?<x>.)/
+        key_name foo
+      ]
+    }
+    assert_nothing_raised {
+      d = create_driver %[
+        remove_prefix foo.bar
+        format /(?<x>.)/
+        key_name foo
+      ]
+    }
+    assert_nothing_raised {
+      d = create_driver %[
+        add_prefix foo.bar
+        format /(?<x>.)/
+        key_name foo
+      ]
+    }
+    assert_nothing_raised {
+      d = create_driver %[
+        remove_prefix foo.baz
+        add_prefix foo.bar
+        format /(?<x>.)/
+        key_name foo
+      ]
+    }
+    assert_raise(Fluent::ConfigError) {
+      d = create_driver %[
+        remove_prefix foo.baz
+        add_prefix foo.bar
+        format /(?<x>.)/
+        key_name foo
+        time_format %Y%m%d
+      ]
+    }
+
+    d = create_driver %[
+      tag foo.bar
+      key_name foo
+      format /(?<x>.)/
+    ]
+    assert_equal false, d.instance.reserve_data
+  end
+
+  # CONFIG = %[
+  #   remove_prefix test
+  #   add_prefix    parsed
+  #   key_name      message
+  #   format        /^(?<x>.)(?<y>.) (?<time>.+)$/
+  #   time_format   %Y%m%d%H%M%S
+  #   reserve_data  true
+  # ]
+  def test_emit
+    d1 = create_driver(CONFIG, 'test.in')
+    time = Time.parse("2012-01-02 13:14:15").to_i
+    d1.run do
+      d1.emit({'message' => '12 20120402182059'}, time)
+      d1.emit({'message' => '34 20120402182100'}, time)
+    end
+    emits = d1.emits
+    assert_equal 2, emits.length
+
+    first = emits[0]
+    assert_equal 'parsed.in', first[0]
+    assert_equal Time.parse("2012-04-02 18:20:59").to_i, first[1]
+    assert_equal '1', first[2]['x']
+    assert_equal '2', first[2]['y']
+    assert_equal '12 20120402182059', first[2]['message']
+
+    second = emits[1]
+    assert_equal 'parsed.in', second[0]
+    assert_equal Time.parse("2012-04-02 18:21:00").to_i, second[1]
+    assert_equal '3', second[2]['x']
+    assert_equal '4', second[2]['y']
+
+    d2 = create_driver(%[
+      tag parsed
+      key_name      data
+      format        /^(?<x>.)(?<y>.) (?<t>.+)$/
+    ], 'test.in')
+    time = Time.parse("2012-04-02 18:20:59").to_i
+    d2.run do
+      d2.emit({'data' => '12 20120402182059'}, time)
+      d2.emit({'data' => '34 20120402182100'}, time)
+    end
+    emits = d2.emits
+    assert_equal 2, emits.length
+
+    first = emits[0]
+    assert_equal 'parsed', first[0]
+    assert_equal time, first[1]
+    assert_nil first[2]['data']
+    assert_equal '1', first[2]['x']
+    assert_equal '2', first[2]['y']
+    assert_equal '20120402182059', first[2]['t']
+
+    second = emits[1]
+    assert_equal 'parsed', second[0]
+    assert_equal time, second[1]
+    assert_nil second[2]['data']
+    assert_equal '3', second[2]['x']
+    assert_equal '4', second[2]['y']
+    assert_equal '20120402182100', second[2]['t']
+  end
+end

metadata

@@ -0,0 +1,92 @@
+--- !ruby/object:Gem::Specification
+name: fluent-plugin-parser
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+  prerelease: 
+platform: ruby
+authors:
+- TAGOMORI Satoshi
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2012-04-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: fluentd
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: fluentd
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+description: fluentd plugin to parse single field, or to combine log structure into
+  single field
+email:
+- tagomoris@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- .gitignore
+- Gemfile
+- LICENSE
+- README.md
+- Rakefile
+- fluent-plugin-parser.gemspec
+- lib/fluent/plugin/out_deparser.rb
+- lib/fluent/plugin/out_parser.rb
+- test/helper.rb
+- test/plugin/test_deparser.rb
+- test/plugin/test_out_parser.rb
+homepage: https://github.com/tagomoris/fluent-plugin-parser
+licenses: []
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 1.8.21
+signing_key: 
+specification_version: 3
+summary: plugin to parse/combine fluentd log messages
+test_files:
+- test/helper.rb
+- test/plugin/test_deparser.rb
+- test/plugin/test_out_parser.rb