fluent-plugin-windows-eventlog 0.1.0 → 0.4.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +5 -5
- data/.gitignore +14 -14
- data/CHANGELOG.md +22 -0
- data/Gemfile +4 -4
- data/LICENSE.txt +203 -203
- data/README.md +285 -66
- data/Rakefile +10 -10
- data/appveyor.yml +24 -0
- data/fluent-plugin-winevtlog.gemspec +28 -25
- data/lib/fluent/plugin/in_windows_eventlog.rb +234 -320
- data/lib/fluent/plugin/in_windows_eventlog2.rb +216 -0
- data/test/generate-windows-event.rb +47 -0
- data/test/helper.rb +33 -29
- data/test/plugin/test_in_windows_eventlog2.rb +214 -0
- data/test/plugin/test_in_winevtlog.rb +48 -51
- metadata +56 -7
data/README.md
CHANGED
|
@@ -1,66 +1,285 @@
|
|
|
1
|
-
# fluent-plugin-windows-eventlog
|
|
2
|
-
|
|
3
|
-
## Component
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
[Fluentd](
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
|
40
|
-
|
|
41
|
-
|
|
|
42
|
-
|
|
|
43
|
-
|
|
44
|
-
|
|
|
45
|
-
|
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
1
|
+
# fluent-plugin-windows-eventlog
|
|
2
|
+
|
|
3
|
+
## Component
|
|
4
|
+
|
|
5
|
+
### fluentd Input plugin for the Windows Event Log
|
|
6
|
+
|
|
7
|
+
[Fluentd](https://www.fluentd.org/) plugin to read the Windows Event Log.
|
|
8
|
+
|
|
9
|
+
## Installation
|
|
10
|
+
ridk exec gem install fluent-plugin-windows-eventlog
|
|
11
|
+
|
|
12
|
+
## Configuration
|
|
13
|
+
|
|
14
|
+
### in_windows_eventlog
|
|
15
|
+
|
|
16
|
+
Check [in_windows_eventlog2](https://github.com/fluent/fluent-plugin-windows-eventlog#in_windows_eventlog2) first. `in_windows_eventlog` will be replaced with `in_windows_eventlog2`.
|
|
17
|
+
|
|
18
|
+
fluentd Input plugin for the Windows Event Log using old Windows Event Logging API
|
|
19
|
+
|
|
20
|
+
<source>
|
|
21
|
+
@type windows_eventlog
|
|
22
|
+
@id windows_eventlog
|
|
23
|
+
channels application,system
|
|
24
|
+
read_interval 2
|
|
25
|
+
tag winevt.raw
|
|
26
|
+
<storage>
|
|
27
|
+
@type local # @type local is the default.
|
|
28
|
+
persistent true # default is true. Set to false to use in-memory storage.
|
|
29
|
+
path ./tmp/storage.json # This is required when persistent is true.
|
|
30
|
+
# Or, please consider using <system> section's `root_dir` parameter.
|
|
31
|
+
</storage>
|
|
32
|
+
</source>
|
|
33
|
+
|
|
34
|
+
#### parameters
|
|
35
|
+
|
|
36
|
+
|name | description |
|
|
37
|
+
|:----- |:----- |
|
|
38
|
+
|`channels` | (option) 'application' as default. One or more of {'application', 'system', 'setup', 'security'}. If you want to read 'setup' or 'security' logs, you must launch fluentd with administrator privileges.|
|
|
39
|
+
|`keys` | (option) A subset of [keys](#read-keys) to read. Defaults to all keys.|
|
|
40
|
+
|`read_interval` | (option) Read interval in seconds. 2 seconds as default.|
|
|
41
|
+
|`from_encoding` | (option) Input character encoding. `nil` as default.|
|
|
42
|
+
|`encoding` | (option) Output character encoding. `nil` as default.|
|
|
43
|
+
|`read_from_head` | (option) Start to read the entries from the oldest, not from when fluentd is started. Defaults to `false`.|
|
|
44
|
+
|`<storage>` | Setting for `storage` plugin for recording read position like `in_tail`'s `pos_file`.|
|
|
45
|
+
|`parse_description`| (option) parse `description` field and set parsed result into the record. `parse` and `string_inserts` fields are removed|
|
|
46
|
+
|
|
47
|
+
##### Available keys
|
|
48
|
+
|
|
49
|
+
This plugin reads the following fields from Windows Event Log entries. Use the `keys` configuration option to select a subset. No other customization is allowed for now.
|
|
50
|
+
|
|
51
|
+
|key|
|
|
52
|
+
|:----- |
|
|
53
|
+
|`record_number` |
|
|
54
|
+
|`time_generated`|
|
|
55
|
+
|`time_written` |
|
|
56
|
+
|`event_id` |
|
|
57
|
+
|`event_type` |
|
|
58
|
+
|`event_category`|
|
|
59
|
+
|`source_name` |
|
|
60
|
+
|`computer_name` |
|
|
61
|
+
|`user` |
|
|
62
|
+
|`description` |
|
|
63
|
+
|`string_inserts`|
|
|
64
|
+
|
|
65
|
+
##### `parse_description` details
|
|
66
|
+
|
|
67
|
+
Here is an example with `parse_description true`.
|
|
68
|
+
|
|
69
|
+
```
|
|
70
|
+
{
|
|
71
|
+
"channel": "security",
|
|
72
|
+
"record_number": "91698",
|
|
73
|
+
"time_generated": "2017-08-29 20:12:29 +0000",
|
|
74
|
+
"time_written": "2017-08-29 20:12:29 +0000",
|
|
75
|
+
"event_id": "4798",
|
|
76
|
+
"event_type": "audit_success",
|
|
77
|
+
"event_category": "13824",
|
|
78
|
+
"source_name": "Microsoft-Windows-Security-Auditing",
|
|
79
|
+
"computer_name": "TEST",
|
|
80
|
+
"user": "",
|
|
81
|
+
"description": "A user's local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-XXX\r\n\tAccount Name:\t\tTEST$\r\n\tAccount Domain:\t\tWORKGROUP\r\n\tLogon ID:\t\t0x3e7\r\n\r\nUser:\r\n\tSecurity ID:\t\tS-XXX-YYY-ZZZ\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tTEST\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x7dc\r\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\r\n",
|
|
82
|
+
"string_inserts": [
|
|
83
|
+
"Administrator",
|
|
84
|
+
"TEST",
|
|
85
|
+
"S-XXX-YYY-ZZZ",
|
|
86
|
+
"S-XXX",
|
|
87
|
+
"TEST$",
|
|
88
|
+
"WORKGROUP",
|
|
89
|
+
"0x3e7",
|
|
90
|
+
"0x7dc",
|
|
91
|
+
"C:\\Windows\\System32\\LogonUI.exe"
|
|
92
|
+
]
|
|
93
|
+
}
|
|
94
|
+
```
|
|
95
|
+
|
|
96
|
+
This record is transformed to
|
|
97
|
+
|
|
98
|
+
```
|
|
99
|
+
{
|
|
100
|
+
"channel": "security",
|
|
101
|
+
"record_number": "91698",
|
|
102
|
+
"time_generated": "2017-08-29 20:12:29 +0000",
|
|
103
|
+
"time_written": "2017-08-29 20:12:29 +0000",
|
|
104
|
+
"event_id": "4798",
|
|
105
|
+
"event_type": "audit_success",
|
|
106
|
+
"event_category": "13824",
|
|
107
|
+
"source_name": "Microsoft-Windows-Security-Auditing",
|
|
108
|
+
"computer_name": "TEST",
|
|
109
|
+
"user": "",
|
|
110
|
+
"description_title": "A user's local group membership was enumerated.",
|
|
111
|
+
"subject.security_id": "S-XXX",
|
|
112
|
+
"subject.account_name": "TEST$",
|
|
113
|
+
"subject.account_domain": "WORKGROUP",
|
|
114
|
+
"subject.logon_id": "0x3e7",
|
|
115
|
+
"user.security_id": "S-XXX-YYY-ZZZ",
|
|
116
|
+
"user.account_name": "Administrator",
|
|
117
|
+
"user.account_domain": "TEST",
|
|
118
|
+
"process_information.process_id": "0x7dc",
|
|
119
|
+
"process_information.process_name": "C:\\Windows\\System32\\LogonUI.exe\r\n"
|
|
120
|
+
}
|
|
121
|
+
```
|
|
122
|
+
|
|
123
|
+
NOTE: This feature assumes `description` field has following formats:
|
|
124
|
+
|
|
125
|
+
- group delimiter: `\r\n\r\n`
|
|
126
|
+
- record delimiter: `\r\n\t`
|
|
127
|
+
- field delimiter: `\t\t`
|
|
128
|
+
|
|
129
|
+
If your `description` doesn't follow this format, the parsed result is only `description_title` field with same `description` content.
|
|
130
|
+
|
|
131
|
+
### in_windows_eventlog2
|
|
132
|
+
|
|
133
|
+
fluentd Input plugin for the Windows Event Log using newer Windows Event Logging API. This is successor to `in_windows_eventlog`. See also [this slide](https://www.slideshare.net/cosmo0920/fluentd-meetup-2019) for the details of `in_windows_eventlog2` plugin.
|
|
134
|
+
|
|
135
|
+
<source>
|
|
136
|
+
@type windows_eventlog2
|
|
137
|
+
@id windows_eventlog2
|
|
138
|
+
channels application,system
|
|
139
|
+
read_interval 2
|
|
140
|
+
tag winevt.raw
|
|
141
|
+
render_as_xml false # default is true.
|
|
142
|
+
rate_limit 200 # default is -1(Winevt::EventLog::Subscribe::RATE_INFINITE).
|
|
143
|
+
<storage>
|
|
144
|
+
@type local # @type local is the default.
|
|
145
|
+
persistent true # default is true. Set to false to use in-memory storage.
|
|
146
|
+
path ./tmp/storage.json # This is required when persistent is true.
|
|
147
|
+
# Or, please consider using <system> section's `root_dir` parameter.
|
|
148
|
+
</storage>
|
|
149
|
+
<parse>
|
|
150
|
+
@type winevt_xml # @type winevt_xml is the default. winevt_xml and none parsers are supported for now.
|
|
151
|
+
</parse>
|
|
152
|
+
</source>
|
|
153
|
+
|
|
154
|
+
**NOTE:** in_windows_eventlog2 always handles EventLog records as UTF-8 characters. Users don't have to specify encoding related parameters and they are not provided.
|
|
155
|
+
|
|
156
|
+
**NOTE:** When `Description` contains error message such as `The message resource is present but the message was not found in the message table.`, eventlog's resource file (.mui) related to error generating event is something wrong. This issue is also occurred in built-in Windows Event Viewer which is the part of Windows management tool.
|
|
157
|
+
|
|
158
|
+
**NOTE:** When `render_as_xml` as `false`, the dependent winevt_c gem renders Windows EventLog as Ruby Hash object directly. This reduces bottleneck to consume EventLog. Specifying `render_as_xml` as `false` should be faster consuming than `render_as_xml` as `true` case.
|
|
159
|
+
|
|
160
|
+
**NOTE:** If you encountered CPU spike due to massively huge EventLog channel, `rate_limit` parameter may help you. Currently, this paramter can handle the multiples of 10 or -1(`Winevt::EventLog::Subscribe::RATE_INFINITE`).
|
|
161
|
+
|
|
162
|
+
#### parameters
|
|
163
|
+
|
|
164
|
+
|name | description |
|
|
165
|
+
|:----- |:----- |
|
|
166
|
+
|`channels` | (option) 'application' as default. One or more of {'application', 'system', 'setup', 'security'}. If you want to read 'setup' or 'security' logs, you must launch fluentd with administrator privileges.|
|
|
167
|
+
|`keys` | (option) A subset of [keys](#read-keys) to read. Defaults to all keys.|
|
|
168
|
+
|`read_interval` | (option) Read interval in seconds. 2 seconds as default.|
|
|
169
|
+
|`from_encoding` | (option) Input character encoding. `nil` as default.|
|
|
170
|
+
|`<storage>` | Setting for `storage` plugin for recording read position like `in_tail`'s `pos_file`.|
|
|
171
|
+
|`<parse>` | Setting for `parser` plugin for parsing raw XML EventLog records. |
|
|
172
|
+
|`parse_description`| (option) parse `description` field and set parsed result into the record. `Description` and `EventData` fields are removed|
|
|
173
|
+
|
|
174
|
+
##### Available keys
|
|
175
|
+
|
|
176
|
+
This plugin reads the following fields from Windows Event Log entries. Use the `keys` configuration option to select a subset. No other customization is allowed for now.
|
|
177
|
+
|
|
178
|
+
|key|
|
|
179
|
+
|:----- |
|
|
180
|
+
|`ProviderName` |
|
|
181
|
+
|`ProviderGuid` |
|
|
182
|
+
|`EventID` |
|
|
183
|
+
|`Qualifiers` |
|
|
184
|
+
|`Level` |
|
|
185
|
+
|`Task` |
|
|
186
|
+
|`Opcode` |
|
|
187
|
+
|`Keywords` |
|
|
188
|
+
|`TimeCreated` |
|
|
189
|
+
|`EventRecordId` |
|
|
190
|
+
|`ActivityID` |
|
|
191
|
+
|`RelatedActivityID`|
|
|
192
|
+
|`ProcessID` |
|
|
193
|
+
|`ThreadID` |
|
|
194
|
+
|`Channel` |
|
|
195
|
+
|`Computer` |
|
|
196
|
+
|`UserID` |
|
|
197
|
+
|`Version` |
|
|
198
|
+
|`Description` |
|
|
199
|
+
|`EventData` |
|
|
200
|
+
|
|
201
|
+
##### `parse_description` details
|
|
202
|
+
|
|
203
|
+
Here is an example with `parse_description true`.
|
|
204
|
+
|
|
205
|
+
```
|
|
206
|
+
{
|
|
207
|
+
"ProviderName": "Microsoft-Windows-Security-Auditing",
|
|
208
|
+
"ProviderGUID": "{D441060A-9695-472B-90BC-24DCA9D503A4}",
|
|
209
|
+
"EventID": "4798",
|
|
210
|
+
"Qualifiers": "",
|
|
211
|
+
"Level": "0",
|
|
212
|
+
"Task": "13824",
|
|
213
|
+
"Opcode": "0",
|
|
214
|
+
"Keywords": "0x8020000000000000",
|
|
215
|
+
"TimeCreated": "2019-06-19T03:10:01.982940200Z",
|
|
216
|
+
"EventRecordID": "87028",
|
|
217
|
+
"ActivityID": "",
|
|
218
|
+
"RelatedActivityID": "{2599DE71-2F70-44AD-9DC8-C5FF2AE8D1EF}",
|
|
219
|
+
"ThreadID": "16888",
|
|
220
|
+
"Channel": "Security",
|
|
221
|
+
"Computer": "DESKTOP-TEST",
|
|
222
|
+
"UserID": "",
|
|
223
|
+
"Version": "0",
|
|
224
|
+
"Description": "A user's local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-X-Y-Z\r\n\tAccount Name:\t\tDESKTOP-TEST$\r\n\tAccount Domain:\t\tWORKGROUP\r\n\tLogon ID:\t\t0x3e7\r\n\r\nUser:\r\n\tSecurity ID:\t\tS-XXX-YYY-ZZZ0\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tDESKTOP-TEST\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0xbac\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n",
|
|
225
|
+
"EventData": [
|
|
226
|
+
"Administrator",
|
|
227
|
+
"DESKTOP-TEST",
|
|
228
|
+
"S-XXX-YYY-ZZZ",
|
|
229
|
+
"S-X-Y-Z",
|
|
230
|
+
"DESKTOP-TEST$",
|
|
231
|
+
"WORKGROUP",
|
|
232
|
+
"0x3e7",
|
|
233
|
+
"0xbac",
|
|
234
|
+
"C:\\Windows\\System32\\svchost.exe"
|
|
235
|
+
]
|
|
236
|
+
}
|
|
237
|
+
```
|
|
238
|
+
|
|
239
|
+
This record is transformed to
|
|
240
|
+
|
|
241
|
+
```
|
|
242
|
+
{
|
|
243
|
+
"ProviderName": "Microsoft-Windows-Security-Auditing",
|
|
244
|
+
"ProviderGUID": "{D441060A-9695-472B-90BC-24DCA9D503A4}",
|
|
245
|
+
"EventID": "4798",
|
|
246
|
+
"Qualifiers": "",
|
|
247
|
+
"Level": "0",
|
|
248
|
+
"Task": "13824",
|
|
249
|
+
"Opcode": "0",
|
|
250
|
+
"Keywords": "0x8020000000000000",
|
|
251
|
+
"TimeCreated": "2019-06-19T03:10:01.982940200Z",
|
|
252
|
+
"EventRecordID": "87028",
|
|
253
|
+
"ActivityID": "",
|
|
254
|
+
"RelatedActivityID": "{2599DE71-2F70-44AD-9DC8-C5FF2AE8D1EF}",
|
|
255
|
+
"ThreadID": "16888",
|
|
256
|
+
"Channel": "Security",
|
|
257
|
+
"Computer": "DESKTOP-TEST",
|
|
258
|
+
"UserID": "",
|
|
259
|
+
"Version": "0",
|
|
260
|
+
"DescriptionTitle": "A user's local group membership was enumerated.",
|
|
261
|
+
"subject.security_id": "S-X-Y-Z",
|
|
262
|
+
"subject.account_name": "DESKTOP-TEST$",
|
|
263
|
+
"subject.account_domain": "WORKGROUP",
|
|
264
|
+
"subject.logon_id": "0x3e7",
|
|
265
|
+
"user.security_id": "S-XXX-YYY-ZZZ",
|
|
266
|
+
"user.account_name": "Administrator",
|
|
267
|
+
"user.account_domain": "DESKTOP-TEST",
|
|
268
|
+
"process_information.process_id": "0xbac",
|
|
269
|
+
"process_information.process_name": "C:\\Windows\\System32\\svchost.exe"
|
|
270
|
+
}
|
|
271
|
+
```
|
|
272
|
+
|
|
273
|
+
NOTE: This feature assumes `description` field has following formats:
|
|
274
|
+
|
|
275
|
+
- group delimiter: `\r\n\r\n`
|
|
276
|
+
- record delimiter: `\r\n\t`
|
|
277
|
+
- field delimiter: `\t\t`
|
|
278
|
+
|
|
279
|
+
If your `description` doesn't follow this format, the parsed result is only `description_title` field with same `description` content.
|
|
280
|
+
|
|
281
|
+
## Copyright
|
|
282
|
+
### Copyright
|
|
283
|
+
Copyright(C) 2014- @okahashi117
|
|
284
|
+
### License
|
|
285
|
+
Apache License, Version 2.0
|
data/Rakefile
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
|
-
require "bundler/gem_tasks"
|
|
2
|
-
require "rake/testtask"
|
|
3
|
-
|
|
4
|
-
Rake::TestTask.new(:test) do |test|
|
|
5
|
-
test.libs << 'lib' << 'test'
|
|
6
|
-
test.pattern = 'test/**/test_*.rb'
|
|
7
|
-
test.verbose = true
|
|
8
|
-
end
|
|
9
|
-
|
|
10
|
-
task default: :test
|
|
1
|
+
require "bundler/gem_tasks"
|
|
2
|
+
require "rake/testtask"
|
|
3
|
+
|
|
4
|
+
Rake::TestTask.new(:test) do |test|
|
|
5
|
+
test.libs << 'lib' << 'test'
|
|
6
|
+
test.pattern = 'test/**/test_*.rb'
|
|
7
|
+
test.verbose = true
|
|
8
|
+
end
|
|
9
|
+
|
|
10
|
+
task default: :test
|
data/appveyor.yml
ADDED
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
version: '{build}'
|
|
2
|
+
|
|
3
|
+
# init:
|
|
4
|
+
# - ps: iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
|
|
5
|
+
|
|
6
|
+
install:
|
|
7
|
+
- SET PATH=C:\Ruby%ruby_version%\bin;%PATH%
|
|
8
|
+
- ruby --version
|
|
9
|
+
- gem --version
|
|
10
|
+
- ridk.cmd exec bundle install
|
|
11
|
+
build: off
|
|
12
|
+
test_script:
|
|
13
|
+
- bundle exec rake test
|
|
14
|
+
# - bundle exec rake test TESTOPTS=-v
|
|
15
|
+
|
|
16
|
+
branches:
|
|
17
|
+
only:
|
|
18
|
+
- master
|
|
19
|
+
|
|
20
|
+
# https://www.appveyor.com/docs/installed-software/#ruby
|
|
21
|
+
environment:
|
|
22
|
+
matrix:
|
|
23
|
+
- ruby_version: "24-x64"
|
|
24
|
+
- ruby_version: "24"
|
|
@@ -1,25 +1,28 @@
|
|
|
1
|
-
# coding: utf-8
|
|
2
|
-
lib = File.expand_path('../lib', __FILE__)
|
|
3
|
-
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
|
4
|
-
|
|
5
|
-
Gem::Specification.new do |spec|
|
|
6
|
-
spec.name = "fluent-plugin-windows-eventlog"
|
|
7
|
-
spec.version = "0.
|
|
8
|
-
spec.authors = ["okahashi117", "Hiroshi Hatake", "Masahiro Nakagawa"]
|
|
9
|
-
spec.email = ["naruki_okahashi@jbat.co.jp", "cosmo0920.
|
|
10
|
-
spec.summary = %q{Fluentd Input plugin to read windows event log.}
|
|
11
|
-
spec.description = %q{Fluentd Input plugin to read
|
|
12
|
-
spec.homepage = "https://github.com/fluent/fluent-plugin-windows-eventlog"
|
|
13
|
-
spec.license = "Apache-2.0"
|
|
14
|
-
|
|
15
|
-
spec.files = `git ls-files -z`.split("\x0")
|
|
16
|
-
spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
|
|
17
|
-
spec.test_files = spec.files.grep(%r{^(test|spec|features)/})
|
|
18
|
-
spec.require_paths = ["lib"]
|
|
19
|
-
|
|
20
|
-
spec.add_development_dependency "bundler"
|
|
21
|
-
spec.add_development_dependency "rake"
|
|
22
|
-
spec.add_development_dependency "test-unit", "~> 3.2.0"
|
|
23
|
-
spec.add_runtime_dependency "fluentd", [">= 0.14.
|
|
24
|
-
spec.add_runtime_dependency "win32-eventlog"
|
|
25
|
-
|
|
1
|
+
# coding: utf-8
|
|
2
|
+
lib = File.expand_path('../lib', __FILE__)
|
|
3
|
+
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
|
4
|
+
|
|
5
|
+
Gem::Specification.new do |spec|
|
|
6
|
+
spec.name = "fluent-plugin-windows-eventlog"
|
|
7
|
+
spec.version = "0.4.0"
|
|
8
|
+
spec.authors = ["okahashi117", "Hiroshi Hatake", "Masahiro Nakagawa"]
|
|
9
|
+
spec.email = ["naruki_okahashi@jbat.co.jp", "cosmo0920.oucc@gmail.com", "repeatedly@gmail.com"]
|
|
10
|
+
spec.summary = %q{Fluentd Input plugin to read windows event log.}
|
|
11
|
+
spec.description = %q{Fluentd Input plugin to read windows event log.}
|
|
12
|
+
spec.homepage = "https://github.com/fluent/fluent-plugin-windows-eventlog"
|
|
13
|
+
spec.license = "Apache-2.0"
|
|
14
|
+
|
|
15
|
+
spec.files = `git ls-files -z`.split("\x0")
|
|
16
|
+
spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
|
|
17
|
+
spec.test_files = spec.files.grep(%r{^(test|spec|features)/})
|
|
18
|
+
spec.require_paths = ["lib"]
|
|
19
|
+
|
|
20
|
+
spec.add_development_dependency "bundler"
|
|
21
|
+
spec.add_development_dependency "rake"
|
|
22
|
+
spec.add_development_dependency "test-unit", "~> 3.2.0"
|
|
23
|
+
spec.add_runtime_dependency "fluentd", [">= 0.14.12", "< 2"]
|
|
24
|
+
spec.add_runtime_dependency "win32-eventlog"
|
|
25
|
+
spec.add_runtime_dependency "winevt_c", ">= 0.6.0"
|
|
26
|
+
spec.add_runtime_dependency "nokogiri", "~> 1.10"
|
|
27
|
+
spec.add_runtime_dependency "fluent-plugin-parser-winevt_xml", ">= 0.1.2"
|
|
28
|
+
end
|