fluent-plugin-systemd 1.1.1 → 1.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: afd6dfa882a391ee1baee61851e2f7d277439e43389857c88278541fbac339cf
-  data.tar.gz: 757d8056bf7e918c18f806bab6437eb9c432ce753a12398c01e7db19c3508d13
+  metadata.gz: f94db112984a3413fe3ba1c596a8f51dae261665defc3fe4bcfc34f24b2a1aa1
+  data.tar.gz: d371e3abd3f24f0d889db702aa5df4ce3bdf54898d9b4d4ce03dcbf74ea3fcf8
 SHA512:
-  metadata.gz: 18e6f3a84a0e44008a37f54e1b245c8af565099640746108d8aa22b17bda6205d7d54ae90b49f00f0ef26664bd947ced40e930ac19327f927f778c1610e88fe2
-  data.tar.gz: e3e5d91220e70391ea08f5ae7a115bbe8e617c3ac1c21ec1660bf4f435c57de679fb23b7b01d4035ed0e47f5ad129543fec2d880e811cbaeb6ba4d43f4c7d6e9
+  metadata.gz: 0fa42e69a59fbf29b074a6c882db1c7e228f646ea6e3ed131f388d5705d1b9af85a9ee4616cb2ccd968118490bd1a1e57f10279a7b8a5f9f4ec6d18e557c5034
+  data.tar.gz: 8d846a57a05c53be90f351d5d4a7ccdd6a1ff3fd0d030ae0ca4aafd21c6f0fe11d7c68f1796d98ac9015fb80ea6e46fd935b6dc300a7b75d42dcd56d5f22fb6d

data/README.md

@@ -69,7 +69,9 @@ If you are upgrading to version 1.0 from a previous version of this plugin take
 
 **`path`**
 
-Path to the systemd journal, defaults to `/var/log/journal`
+Path to the systemd journal **directory**, defaults to `/var/log/journal`.
+
+This must be a directory, not an individual file or a glob pattern — for example, `/var/log/journal/*.journal` will not work. All journal files in the given directory are read automatically.
 
 **`filters`**
 
@@ -141,6 +143,13 @@ If true, lowercase all non-mapped fields. Defaults to false.
 
 If true, strip leading underscores from all non-mapped fields. Defaults to false.
 
+Journald reserves the leading underscore for its trusted fields, which a client cannot forge,
+ while a client is free to send a user field with the same name minus the underscore.
+Stripping makes both names collide, so the trusted field wins and the user field of that name is dropped.
+For example, if an entry holds `_SYSTEMD_UNIT` and a client supplied `SYSTEMD_UNIT`,
+the result only holds the trusted value.
+Map the trusted field to another name with `field_map` if you need to keep both.
+
 ### Filter Example
 
 Given a systemd journal source entry:

data/lib/fluent/plugin/in_systemd.rb

@@ -50,7 +50,8 @@ module Fluent
       def configure(conf)
         super
         @journal = nil
-        @pos_storage = storage_create(usage: 'positions')
+        config = conf.elements.find { |e| e.name == 'storage' }
+        @pos_storage = storage_create(usage: 'positions', conf: config, default_type: DEFAULT_STORAGE_TYPE)
         @mutator = SystemdEntryMutator.new(**@entry_opts.to_h)
         @mutator.warnings.each { |warning| log.warn(warning) }
       end

data/lib/fluent/plugin/systemd/entry_mutator.rb

@@ -15,6 +15,7 @@
 #   limitations under the License.
 
 require 'fluent/config/error'
+require 'systemd/journal/fields'
 
 module Fluent
   module Plugin
@@ -33,7 +34,7 @@ module Fluent
     #   "<new_field1>" => ["<source_field1>", "<source_field2>"],
     #   "<new_field2>" => ["<source_field2>"]
     # }
-    class SystemdEntryMutator
+    class SystemdEntryMutator # rubocop:disable Metrics/ClassLength
       Options = Struct.new(
         :field_map,
         :field_map_strict,
@@ -41,6 +42,8 @@ module Fluent
         :fields_strip_underscores
       )
 
+      TRUSTED_FIELDS = (Systemd::Journal::TRUSTED_FIELDS + Systemd::Journal::KERNEL_FIELDS).freeze
+
       def self.default_opts
         Options.new({}, false, false, false)
       end
@@ -103,13 +106,20 @@ module Fluent
       # mapped - Optional hash that represents a previously mapped entry to
       #          which the formatted fields will be added
       def format_fields(entry, mapped = nil)
+        reserved = reserved_field_names(entry)
         entry.each_with_object(mapped || {}) do |(fld, val), formatted_entry|
           # don't mess with explicitly mapped fields
           next if @map_src_fields.include?(fld)
 
-          fld = format_field_name(fld)
+          name = format_field_name(fld)
+          # A client may send `SYSTEMD_UNIT` but never `_SYSTEMD_UNIT`, so the
+          # trusted field keeps the name when stripping underscores makes the
+          # two collide. Otherwise any local process could fake the journal
+          # metadata that the trusted fields are supposed to guarantee.
+          next if !fld.start_with?('_') && reserved.include?(name)
+
           # account for mapping (appending) to an existing systemd field
-          formatted_entry[fld] = join_if_needed([val, mapped[fld]])
+          formatted_entry[name] = join_if_needed([val, mapped[name]])
         end
       end
 
@@ -128,6 +138,25 @@ module Fluent
         values.join(' ')
       end
 
+      def reserved_field_names(entry)
+        return [] unless @opts.fields_strip_underscores
+
+        trusted_field_names(entry).each_with_object([]) do |fld, names|
+          name = format_field_name(fld)
+          next if @map_src_fields.include?(fld) && !Array(@opts.field_map[fld]).include?(name)
+
+          names << name
+        end
+      end
+
+      # Journald never lets a client send a leading underscore, so the known
+      # trusted names stay reserved even when this entry does not carry them.
+      def trusted_field_names(entry)
+        entry.each_with_object(TRUSTED_FIELDS.dup) do |(fld, _val), flds|
+          flds << fld if fld.start_with?('_')
+        end
+      end
+
       def format_field_name(name)
         name = name.gsub(/\A_+/, '') if @opts.fields_strip_underscores
         name = name.downcase if @opts.fields_lowercase

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-systemd
 version: !ruby/object:Gem::Version
-  version: 1.1.1
+  version: 1.1.2
 platform: ruby
 authors:
 - Ed Robinson
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-02-28 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -112,11 +111,13 @@ files:
 - lib/fluent/plugin/filter_systemd_entry.rb
 - lib/fluent/plugin/in_systemd.rb
 - lib/fluent/plugin/systemd/entry_mutator.rb
-homepage: https://github.com/reevoo/fluent-plugin-systemd
+homepage: https://github.com/fluent-plugins-nursery/fluent-plugin-systemd
 licenses:
 - Apache-2.0
-metadata: {}
-post_install_message:
+metadata:
+  homepage_uri: https://github.com/fluent-plugins-nursery/fluent-plugin-systemd
+  source_code_uri: https://github.com/fluent-plugins-nursery/fluent-plugin-systemd
+  bug_tracker_uri: https://github.com/fluent-plugins-nursery/fluent-plugin-systemd/issues
 rdoc_options: []
 require_paths:
 - lib
@@ -131,8 +132,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Input plugin to read from systemd journal.
 test_files: []