fluent-plugin-windows-eventlog 0.4.5 → 0.5.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b22aa563236f503aa9b606c6848b223995eab6174cf5ab244ef9cf535afcb8c9
-  data.tar.gz: 90dfddd1015ff28d730d11168fe60466e6a9c69b9c436601fb25eff867c935b0
+  metadata.gz: f42851f147127453f0392e3e14ab31ed86983508c75453d9b41d2674441d8abc
+  data.tar.gz: fbfe63f1ee0034df3fd4346376b728b6728105b76130c82902768e67b4b5c1fe
 SHA512:
-  metadata.gz: 57f27df3303f3424057f4fce75d7a12c804cc7bd5ecc2c8cf9579512dd9dc29c944ebea038541bbdac508028c9da669a246ac754c572fac19e3028ecabefab8c
-  data.tar.gz: 78d02ada2bbc70fc91df533fdcd7f47a4d680707c06f1a26eaa014a2c57435c90d2e47c3d82b3c43d81229ffabc3e2f7791d397bf168d11911b20a8d4a451250
+  metadata.gz: a8326aa48c8661fcc9165e708db19ea3a4dd5ff0ec1407c35b7a6ef4db29fda70816eaba2c0a7b2e4e8c1255d47626b1330d8e1725c869e1ed7c5601e1681070
+  data.tar.gz: 22d9526b59591eca30044c625107a8aecc51c5e9b85448607450fec333e7630c44dccf4cc737539b5131d78bff1c2225f6ab0eb0f618832ffb06bc0b70c9ecd0

data/CHANGELOG.md

@@ -1,3 +1,19 @@
+# Release v0.5.3 - 2020/03/17
+* in_windows_eventlog2: Add Qualifiers key handling options
+
+# Release v0.5.2 - 2020/02/28
+* in_windows_eventlog2: Add parameter to read from all channels shortcut
+
+# Release v0.5.1 - 2020/02/26
+* in_windows_eventlog2: Add empty bookmark checking mechanism
+
+# Release v0.5.0 - 2020/02/17
+* in_windows_eventlog2: Support subscribe directive to handle read_existing_events paratemer each of channels.
+* in_windows_eventlog2: Depends on winevt_c v0.7.0 or later.
+
+# Release v0.4.6 - 2020/02/15
+* Fix winevt_c dependency to prevent fetching winevt_c v0.7.0 or later.
+
 # Release v0.4.5 - 2020/01/28
 * in_windows_eventlog2: Handle empty key case in parsing description method.
 

data/README.md

@@ -135,11 +135,13 @@ fluentd Input plugin for the Windows Event Log using newer Windows Event Logging
     <source>
       @type windows_eventlog2
       @id windows_eventlog2
-      channels application,system
+      channels application,system # Also be able to use `<subscribe>` directive.
+      read_existing_events false
       read_interval 2
       tag winevt.raw
       render_as_xml false       # default is true.
       rate_limit 200            # default is -1(Winevt::EventLog::Subscribe::RATE_INFINITE).
+      # preserve_qualifiers_on_hash true # default is false.
       <storage>
         @type local             # @type local is the default.
         persistent true         # default is true. Set to false to use in-memory storage.
@@ -148,7 +150,16 @@ fluentd Input plugin for the Windows Event Log using newer Windows Event Logging
       </storage>
       <parse>
         @type winevt_xml # @type winevt_xml is the default. winevt_xml and none parsers are supported for now.
+        # When set up it as true, this plugin preserves "Qualifiers" and "EventID" keys.
+        # When set up it as false, this plugin calculates actual "EventID" from "Qualifiers" and removing "Qualifiers".
+        # With the following equation:
+        # (EventID & 0xffff) | (Qualifiers & 0xffff) << 16
+        preserve_qualifiers true
       </parse>
+      # <subscribe>
+      #   channles application, system
+      #   read_existing_events false # read_existing_events should be applied each of subscribe directive(s)
+      # </subscribe>
     </source>
 
 **NOTE:** in_windows_eventlog2 always handles EventLog records as UTF-8 characters. Users don't have to specify encoding related parameters and they are not provided.
@@ -163,13 +174,62 @@ fluentd Input plugin for the Windows Event Log using newer Windows Event Logging
 
 |name      | description |
 |:-----    |:-----       |
-|`channels`         | (option) 'application' as default. One or more of {'application', 'system', 'setup', 'security'}. If you want to read 'setup' or 'security' logs, you must launch fluentd with administrator privileges.|
+|`channels`         | (option) No default value just empty array, but 'application' is used as default due to backward compatibility. One or more of {'application', 'system', 'setup', 'security'}. If you want to read 'setup' or 'security' logs, you must launch fluentd with administrator privileges.|
 |`keys`             | (option) A subset of [keys](#read-keys) to read. Defaults to all keys.|
 |`read_interval`    | (option) Read interval in seconds. 2 seconds as default.|
 |`from_encoding`    | (option) Input character encoding. `nil` as default.|
 |`<storage>`        | Setting for `storage` plugin for recording read position like `in_tail`'s `pos_file`.|
 |`<parse>`          | Setting for `parser` plugin for parsing raw XML EventLog records. |
 |`parse_description`| (option) parse `description` field and set parsed result into the record. `Description` and `EventData` fields are removed|
+|`read_from_head`   | **Deprecated** (option) Start to read the entries from the oldest, not from when fluentd is started. Defaults to `false`.|
+|`read_existing_events` | (option) Read the entries which already exist before fluentd is started. Defaults to `false`.|
+|`render_as_xml` | (option) Render Windows EventLog as XML or Ruby Hash object directly. Defaults to `true`.|
+|`rate_limit`      | (option) Specify rate limit to consume EventLog. Default is `Winevt::EventLog::Subscribe::RATE_INFINITE`.|
+|`preserve_qualifiers_on_hash`      | (option) When set up it as true, this plugin preserves "Qualifiers" and "EventID" keys. When set up it as false, this plugin calculates actual "EventID" from "Qualifiers" and removing "Qualifiers". Default is `false`.|
+|`read_all_channels`| (option) Read from all channels. Default is `false`|
+|`<subscribe>`          | Setting for subscribe channels. |
+
+##### subscribe section
+
+|name      | description |
+|:-----    |:-----       |
+|`channels`             | One or more of {'application', 'system', 'setup', 'security'}. If you want to read 'setup' or 'security' logs, you must launch fluentd with administrator privileges. |
+|`read_existing_events` | (option) Read the entries which already exist before fluentd is started. Defaults to `false`. |
+
+
+**Motivation:** subscribe directive is designed for applying `read_existing_events` each of channels which is specified in subscribe section(s).
+
+e.g) The previous configuration can handle `read_existing_events` but this parameter only specifies `read_existing_events` or not for channels which are specified in `channels`.
+
+```aconf
+channels ["Application", "Security", "HardwareEvents"]
+read_existing_events true
+```
+
+is interpreted as "Application", "Security", and "HardwareEvents" should be read existing events.
+
+But some users want to configure to:
+
+* "Application" and "Security" channels just tailing
+* "HardwareEvent" channel read existing events before launching Fluentd
+
+With `<subscribe>` directive, this requirements can be represendted as:
+
+```aconf
+<subscribe>
+  channles ["Application", "Security"]
+  # read_existing_events false
+</subscribe>
+<subscribe>
+  channles ["HardwareEvent"]
+  read_existing_events true
+</subscribe>
+```
+
+This configuration can be handled as:
+
+* "Application" and "Security" channels just tailing
+* "HardwareEvent" channel read existing events before launching Fluentd
 
 ##### Available keys
 

data/fluent-plugin-winevtlog.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "fluent-plugin-windows-eventlog"
-  spec.version       = "0.4.5"
+  spec.version       = "0.5.3"
   spec.authors       = ["okahashi117", "Hiroshi Hatake", "Masahiro Nakagawa"]
   spec.email         = ["naruki_okahashi@jbat.co.jp", "cosmo0920.oucc@gmail.com", "repeatedly@gmail.com"]
   spec.summary       = %q{Fluentd Input plugin to read windows event log.}
@@ -22,7 +22,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "test-unit", "~> 3.2.0"
   spec.add_runtime_dependency "fluentd", [">= 0.14.12", "< 2"]
   spec.add_runtime_dependency "win32-eventlog"
-  spec.add_runtime_dependency "winevt_c", ">= 0.6.1"
+  spec.add_runtime_dependency "winevt_c", ">= 0.7.1"
   spec.add_runtime_dependency "nokogiri", "~> 1.10"
   spec.add_runtime_dependency "fluent-plugin-parser-winevt_xml", ">= 0.1.2"
 end

data/lib/fluent/plugin/bookmark_sax_parser.rb

@@ -0,0 +1,30 @@
+require 'nokogiri'
+
+class WinevtBookmarkDocument < Nokogiri::XML::SAX::Document
+  attr_reader :result
+
+  def initialize
+    @result = {}
+    super
+  end
+
+  def start_document
+  end
+
+  def start_element(name, attributes = [])
+    if name == "Bookmark"
+      @result[:channel] = attributes[0][1] rescue nil
+      @result[:record_id] = attributes[1][1].to_i rescue nil
+      @result[:is_current] = attributes[2][1].downcase == "true" rescue nil
+    end
+  end
+
+  def characters(string)
+  end
+
+  def end_element(name, attributes = [])
+  end
+
+  def end_document
+  end
+end

data/lib/fluent/plugin/in_windows_eventlog.rb

@@ -49,6 +49,7 @@ module Fluent::Plugin
     end
 
     def configure(conf)
+      log.warn "in_windows_eventlog is deprecated. It will be removed in the future version."
       super
       @chs = @channels.map {|ch| ch.strip.downcase }.uniq
       if @chs.empty?

data/lib/fluent/plugin/in_windows_eventlog2.rb

@@ -1,6 +1,7 @@
 require 'winevt'
 require 'fluent/plugin/input'
 require 'fluent/plugin'
+require_relative 'bookmark_sax_parser'
 
 module Fluent::Plugin
   class WindowsEventLog2Input < Input
@@ -32,12 +33,20 @@ module Fluent::Plugin
 
     config_param :tag, :string
     config_param :read_interval, :time, default: 2
-    config_param :channels, :array, default: ['application']
+    config_param :channels, :array, default: []
     config_param :keys, :array, default: []
-    config_param :read_from_head, :bool, default: false
+    config_param :read_from_head, :bool, default: false, deprecated: "Use `read_existing_events' instead."
+    config_param :read_existing_events, :bool, default: false
     config_param :parse_description, :bool, default: false
     config_param :render_as_xml, :bool, default: true
     config_param :rate_limit, :integer, default: Winevt::EventLog::Subscribe::RATE_INFINITE
+    config_param :preserve_qualifiers_on_hash, :bool, default: false
+    config_param :read_all_channels, :bool, default: false
+
+    config_section :subscribe, param_name: :subscribe_configs, required: false, multi: true do
+      config_param :channels, :array
+      config_param :read_existing_events, :bool, default: false
+    end
 
     config_section :storage do
       config_set_default :usage, "bookmarks"
@@ -58,18 +67,40 @@ module Fluent::Plugin
 
     def configure(conf)
       super
-      @chs = @channels.map {|ch| ch.strip.downcase }.uniq
+      @chs = []
+      @all_chs = Winevt::EventLog::Channel.new
+      @all_chs.force_enumerate = false
+
+      if @read_all_channels
+        @all_chs.each do |ch|
+          uch = ch.strip.downcase
+          @chs.push([uch, @read_existing_events])
+        end
+      end
+
+      @read_existing_events = @read_from_head || @read_existing_events
+      if @channels.empty? && @subscribe_configs.empty? && !@read_all_channels
+        @chs.push(['application', @read_existing_events])
+      else
+        @channels.map {|ch| ch.strip.downcase }.uniq.each do |uch|
+          @chs.push([uch, @read_existing_events])
+        end
+        @subscribe_configs.each do |subscribe|
+          subscribe.channels.map {|ch| ch.strip.downcase }.uniq.each do |uch|
+            @chs.push([uch, subscribe.read_existing_events])
+          end
+        end
+      end
+      @chs.uniq!
       @keynames = @keys.map {|k| k.strip }.uniq
       if @keynames.empty?
         @keynames = KEY_MAP.keys
       end
-      @keynames.delete('Qualifiers') unless @render_as_xml
-      @keynames.delete('EventData') if @parse_description
 
       @tag = tag
-      @tailing = @read_from_head ? false : true
       @bookmarks_storage = storage_create(usage: "bookmarks")
       @winevt_xml = false
+      @parser = nil
       if @render_as_xml
         @parser = parser_create
         @winevt_xml = @parser.respond_to?(:winevt_xml?) && @parser.winevt_xml?
@@ -81,35 +112,66 @@ module Fluent::Plugin
           alias_method :on_notify, :on_notify_hash
         end
       end
+
+      if @render_as_xml && @preserve_qualifiers_on_hash
+        raise Fluent::ConfigError, "preserve_qualifiers_on_hash must be used with Hash object rendering(render_as_xml as false)."
+      end
+      if !@render_as_xml && !@preserve_qualifiers_on_hash
+        @keynames.delete('Qualifiers')
+      elsif @parser.respond_to?(:preserve_qualifiers?) && !@parser.preserve_qualifiers?
+        @keynames.delete('Qualifiers')
+      end
+      @keynames.delete('EventData') if @parse_description
     end
 
     def start
       super
 
-      @chs.each do |ch|
-        bookmarkXml = @bookmarks_storage.get(ch) || ""
-        subscribe = Winevt::EventLog::Subscribe.new
-        bookmark = unless bookmarkXml.empty?
-                     Winevt::EventLog::Bookmark.new(bookmarkXml)
-                   else
-                     nil
-                   end
-        subscribe.tail = @tailing
-        begin
-          subscribe.subscribe(ch, "*", bookmark)
-        rescue Winevt::EventLog::Query::Error => e
-          raise Fluent::ConfigError, "Invalid Bookmark XML is loaded. #{e}"
-        end
-        subscribe.render_as_xml = @render_as_xml
-        subscribe.rate_limit = @rate_limit
-        timer_execute("in_windows_eventlog_#{escape_channel(ch)}".to_sym, @read_interval) do
-          on_notify(ch, subscribe)
+      @chs.each do |ch, read_existing_events|
+        subscribe_channel(ch, read_existing_events)
+      end
+    end
+
+    def subscribe_channel(ch, read_existing_events)
+      bookmarkXml = @bookmarks_storage.get(ch) || ""
+      bookmark = nil
+      if bookmark_validator(bookmarkXml, ch)
+        bookmark = Winevt::EventLog::Bookmark.new(bookmarkXml)
+      end
+      subscribe = Winevt::EventLog::Subscribe.new
+      subscribe.read_existing_events = read_existing_events
+      begin
+        subscribe.subscribe(ch, "*", bookmark)
+        if !@render_as_xml && @preserve_qualifiers_on_hash && subscribe.respond_to?(:preserve_qualifiers=)
+          subscribe.preserve_qualifiers = @preserve_qualifiers_on_hash
         end
+      rescue Winevt::EventLog::Query::Error => e
+        raise Fluent::ConfigError, "Invalid Bookmark XML is loaded. #{e}"
+      end
+      subscribe.render_as_xml = @render_as_xml
+      subscribe.rate_limit = @rate_limit
+      timer_execute("in_windows_eventlog_#{escape_channel(ch)}".to_sym, @read_interval) do
+        on_notify(ch, subscribe)
+      end
+    end
+
+    def bookmark_validator(bookmarkXml, channel)
+      return false if bookmarkXml.empty?
+
+      evtxml = WinevtBookmarkDocument.new
+      parser = Nokogiri::XML::SAX::Parser.new(evtxml)
+      parser.parse(bookmarkXml)
+      result = evtxml.result
+      if !result.empty? && (result[:channel].downcase == channel.downcase) && result[:is_current]
+        true
+      else
+        log.warn "This stored bookmark is incomplete for using. Referring `read_existing_events` parameter to subscribe: #{bookmarkXml}, channel: #{channel}"
+        false
       end
     end
 
     def escape_channel(ch)
-      ch.gsub(/[^a-zA-Z0-9]/, '_')
+      ch.gsub(/[^a-zA-Z0-9\s]/, '_')
     end
 
     def on_notify(ch, subscribe)

data/test/helper.rb

@@ -25,6 +25,7 @@ end
 require 'fluent/test/driver/input'
 require 'fluent/plugin/in_windows_eventlog'
 require 'fluent/plugin/in_windows_eventlog2'
+require 'fluent/plugin/bookmark_sax_parser'
 
 class Test::Unit::TestCase
 end

data/test/plugin/test_bookmark_sax_parser.rb

@@ -0,0 +1,41 @@
+require_relative '../helper'
+
+class BookmarkSAXParserTest < Test::Unit::TestCase
+
+  def setup
+    @evtxml = WinevtBookmarkDocument.new
+    @parser = Nokogiri::XML::SAX::Parser.new(@evtxml)
+  end
+
+  def test_parse
+    bookmark_str = <<EOS
+<BookmarkList>
+  <Bookmark Channel='Application' RecordId='161332' IsCurrent='true'/>
+</BookmarkList>
+EOS
+    @parser.parse(bookmark_str)
+    expected = {channel: "Application", record_id: 161332, is_current: true}
+    assert_equal expected, @evtxml.result
+  end
+
+  def test_parse_2
+    bookmark_str = <<EOS
+<BookmarkList>
+  <Bookmark Channel='Security' RecordId='25464' IsCurrent='true'/>
+</BookmarkList>
+EOS
+    @parser.parse(bookmark_str)
+    expected = {channel: "Security", record_id: 25464, is_current: true}
+    assert_equal expected, @evtxml.result
+  end
+
+  def test_parse_empty_bookmark_list
+    bookmark_str = <<EOS
+<BookmarkList>
+</BookmarkList>
+EOS
+    @parser.parse(bookmark_str)
+    expected = {}
+    assert_equal expected, @evtxml.result
+  end
+end

data/test/plugin/test_in_windows_eventlog2.rb

@@ -23,11 +23,98 @@ class WindowsEventLog2InputTest < Test::Unit::TestCase
     d = create_driver CONFIG
     assert_equal 'fluent.eventlog', d.instance.tag
     assert_equal 2, d.instance.read_interval
-    assert_equal ['application'], d.instance.channels
-    assert_false d.instance.read_from_head
+    assert_equal [], d.instance.channels
+    assert_false d.instance.read_existing_events
     assert_true d.instance.render_as_xml
   end
 
+  sub_test_case "configure" do
+    test "subscribe directive" do
+      d = create_driver config_element("ROOT", "", {"tag" => "fluent.eventlog"}, [
+                                         config_element("storage", "", {
+                                                          '@type' => 'local',
+                                                          'persistent' => false
+                                                        }),
+                                         config_element("subscribe", "", {
+                                                          'channels' => ['System', 'Windows PowerShell'],
+                                                        }),
+                                         config_element("subscribe", "", {
+                                                          'channels' => ['Security'],
+                                                          'read_existing_events' => true
+                                                        }),
+                                       ])
+      expected = [["system", false], ["windows powershell", false], ["security", true]]
+      assert_equal expected, d.instance.instance_variable_get(:@chs)
+    end
+
+    test "duplicated subscribe" do
+      d = create_driver config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                    "channels" => ["System", "Windows PowerShell"]
+                                                   }, [
+                                         config_element("storage", "", {
+                                                          '@type' => 'local',
+                                                          'persistent' => false
+                                                        }),
+                                         config_element("subscribe", "", {
+                                                          'channels' => ['System', 'Windows PowerShell'],
+                                                        }),
+                                         config_element("subscribe", "", {
+                                                          'channels' => ['Security'],
+                                                          'read_existing_events' => true
+                                                        }),
+                                       ])
+      expected = [["system", false], ["windows powershell", false], ["security", true]]
+      assert_equal 1, d.instance.instance_variable_get(:@chs).select {|ch, flag| ch == "system"}.size
+      assert_equal expected, d.instance.instance_variable_get(:@chs)
+    end
+
+    test "non duplicated subscribe" do
+      d = create_driver config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                    "channels" => ["System", "Windows PowerShell"]
+                                                   }, [
+                                         config_element("storage", "", {
+                                                          '@type' => 'local',
+                                                          'persistent' => false
+                                                        }),
+                                         config_element("subscribe", "", {
+                                                          'channels' => ['System', 'Windows PowerShell'],
+                                                          'read_existing_events' => true
+                                                        }),
+                                         config_element("subscribe", "", {
+                                                          'channels' => ['Security'],
+                                                          'read_existing_events' => true
+                                                        }),
+                                       ])
+      expected = [["system", false], ["windows powershell", false], ["system", true], ["windows powershell", true], ["security", true]]
+      assert_equal 2, d.instance.instance_variable_get(:@chs).select {|ch, flag| ch == "system"}.size
+      assert_equal expected, d.instance.instance_variable_get(:@chs)
+    end
+
+    test "invalid combination for preserving qualifiers" do
+      assert_raise(Fluent::ConfigError) do
+        create_driver config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                  "render_as_xml" => true,
+                                                  "preserve_qualifiers_on_hash" => true,
+                                                 }, [
+                                       config_element("storage", "", {
+                                                        '@type' => 'local',
+                                                        'persistent' => false
+                                                      }),
+                                     ])
+      end
+    end
+  end
+
+  data("application"        => ["Application", "Application"],
+       "windows powershell" => ["Windows PowerShell", "Windows PowerShell"],
+       "escaped"            => ["Should_Be_Escaped_", "Should+Be;Escaped/"]
+      )
+  def test_escape_channel(data)
+    expected, actual = data
+    d = create_driver CONFIG
+    assert_equal expected, d.instance.escape_channel(actual)
+  end
+
   def test_parse_desc
     d = create_driver
     desc =<<-DESC
@@ -180,6 +267,37 @@ DESC
       assert_equal("4", record["Level"])
       assert_equal("fluent-plugins", record["ProviderName"])
     end
+
+    def test_write_with_preserving_qualifiers
+      require 'winevt'
+
+      d = create_driver(config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                    "render_as_xml" => false,
+                                                    'preserve_qualifiers_on_hash' => true
+                                                   }, [
+                                         config_element("storage", "", {
+                                                          '@type' => 'local',
+                                                          'persistent' => false
+                                                        }),
+                                       ]))
+
+      service = Fluent::Plugin::EventService.new
+      subscribe = Winevt::EventLog::Subscribe.new
+
+      omit "@parser.preserve_qualifiers does not respond" unless subscribe.respond_to?(:preserve_qualifiers?)
+
+      d.run(expect_emits: 1) do
+        service.run
+      end
+
+      assert(d.events.length >= 1)
+      event = d.events.last
+      record = event.last
+
+      assert_true(record.has_key?("Description"))
+      assert_true(record.has_key?("EventData"))
+      assert_true(record.has_key?("Qualifiers"))
+    end
   end
 
   class PersistBookMark < self
@@ -188,6 +306,7 @@ DESC
                                config_element("storage", "", {
                                                 '@type' => 'local',
                                                 '@id' => 'test-02',
+                                                '@log_level' => "info",
                                                 'path' => File.join(TEST_PLUGIN_STORAGE_PATH,
                                                                     'json', 'test-02.json'),
                                                 'persistent' => true,
@@ -251,6 +370,21 @@ EOS
       assert_raise(Fluent::ConfigError) do
         d2.instance.start
       end
+      assert_equal 0, d2.logs.grep(/This stored bookmark is incomplete for using. Referring `read_existing_events` parameter to subscribe:/).length
+    end
+
+    def test_start_with_empty_bookmark
+      invalid_storage_contents = <<-EOS
+<BookmarkList>\r\n</BookmarkList>
+EOS
+      d = create_driver(CONFIG2)
+      storage = d.instance.instance_variable_get(:@bookmarks_storage)
+      storage.put('application', invalid_storage_contents)
+      assert File.exist?(File.join(TEST_PLUGIN_STORAGE_PATH, 'json', 'test-02.json'))
+
+      d2 = create_driver(CONFIG2)
+      d2.instance.start
+      assert_equal 1, d2.logs.grep(/This stored bookmark is incomplete for using. Referring `read_existing_events` parameter to subscribe:/).length
     end
   end
 
@@ -283,4 +417,33 @@ EOS
     assert_true(record.has_key?("Description"))
     assert_true(record.has_key?("EventData"))
   end
+
+  def test_write_with_winevt_xml_parser_without_qualifiers
+    d = create_driver(config_element("ROOT", "", {"tag" => "fluent.eventlog"}, [
+                                       config_element("storage", "", {
+                                                        '@type' => 'local',
+                                                        'persistent' => false
+                                                      }),
+                                       config_element("parse", "", {
+                                                        '@type' => 'winevt_xml',
+                                                        'preserve_qualifiers' => false
+                                                      }),
+                                     ]))
+
+    service = Fluent::Plugin::EventService.new
+
+    omit "@parser.preserve_qualifiers does not respond" unless d.instance.instance_variable_get(:@parser).respond_to?(:preserve_qualifiers?)
+
+    d.run(expect_emits: 1) do
+      service.run
+    end
+
+    assert(d.events.length >= 1)
+    event = d.events.last
+    record = event.last
+
+    assert_true(record.has_key?("Description"))
+    assert_true(record.has_key?("EventData"))
+    assert_false(record.has_key?("Qualifiers"))
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-windows-eventlog
 version: !ruby/object:Gem::Version
-  version: 0.4.5
+  version: 0.5.3
 platform: ruby
 authors:
 - okahashi117
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-28 00:00:00.000000000 Z
+date: 2020-03-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -94,14 +94,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.6.1
+        version: 0.7.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.6.1
+        version: 0.7.1
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -147,11 +147,13 @@ files:
 - Rakefile
 - appveyor.yml
 - fluent-plugin-winevtlog.gemspec
+- lib/fluent/plugin/bookmark_sax_parser.rb
 - lib/fluent/plugin/in_windows_eventlog.rb
 - lib/fluent/plugin/in_windows_eventlog2.rb
 - test/data/eventid_6416
 - test/generate-windows-event.rb
 - test/helper.rb
+- test/plugin/test_bookmark_sax_parser.rb
 - test/plugin/test_in_windows_eventlog2.rb
 - test/plugin/test_in_winevtlog.rb
 homepage: https://github.com/fluent/fluent-plugin-windows-eventlog
@@ -182,5 +184,6 @@ test_files:
 - test/data/eventid_6416
 - test/generate-windows-event.rb
 - test/helper.rb
+- test/plugin/test_bookmark_sax_parser.rb
 - test/plugin/test_in_windows_eventlog2.rb
 - test/plugin/test_in_winevtlog.rb