fluent-plugin-windows-eventlog 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 59131dc675a5af717f4f3d693af1f902d76aa7b557e82c14431cd310f28cf999
-  data.tar.gz: f130a09fbb2c8a35a287869447e1486b3d21d371bc1acf4744ebd1a471e76edf
+  metadata.gz: 06511272a8c96f22e69b50f60d2a6c5b7ac377c0c446d48fc842cc4e2b272b7b
+  data.tar.gz: 78635a96981173d47b640f887b62e4ba7d0d773b1eaf39bfb0c59be488073364
 SHA512:
-  metadata.gz: 6b9e107c6dd037cc4c2ef391cacf6636884a210a3c7058770972c0968603c8600267babaeee7cebb3dc75259c13d3aa0697e3a1980c06cba3d0daf26912b063e
-  data.tar.gz: 8e41835e28cf0ad5ba6a73d50c985518c001988a721a5fdee2dd4820d48e656835b4e26d19eeefdd0c3db62ee701f29d957efcff7d87f0ade7449f720c8f6849
+  metadata.gz: ccabe68cf1bd5188e12f3eaa46670488b6eb458aca556d15d09022489722bf5be9ca6cace64b93abbb2d4aeecb5a4a8210a2e9787de96a201d6a24bdca201f1a
+  data.tar.gz: 290a21af0606ef47c61e3f9c63f45b25b0f1d90dcf2268a950c3f460e02faa59e72b4a0e6bdc3452bae10121c550b53d4b410610c587042498837075e081977e

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+# Release v0.4.2 - 2019/10/16
+* in_windows_eventlog2: Handle invalid data error from `Winevt::EventLog::Query::Error`
+
 # Release v0.4.1 - 2019/10/11
 * in_windows_eventlog2: Add a missing ProcessID record
 

data/fluent-plugin-winevtlog.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "fluent-plugin-windows-eventlog"
-  spec.version       = "0.4.1"
+  spec.version       = "0.4.2"
   spec.authors       = ["okahashi117", "Hiroshi Hatake", "Masahiro Nakagawa"]
   spec.email         = ["naruki_okahashi@jbat.co.jp", "cosmo0920.oucc@gmail.com", "repeatedly@gmail.com"]
   spec.summary       = %q{Fluentd Input plugin to read windows event log.}

data/lib/fluent/plugin/in_windows_eventlog2.rb

@@ -110,35 +110,40 @@ module Fluent::Plugin
 
     def on_notify_xml(ch, subscribe)
       es = Fluent::MultiEventStream.new
-      subscribe.each do |xml, message, string_inserts|
-        @parser.parse(xml) do |time, record|
-          # record.has_key?("EventData") for none parser checking.
-          if @winevt_xml
-            record["Description"] = message
-            record["EventData"] = string_inserts
-
-            h = {}
-            @keynames.each do |k|
-              type = KEY_MAP[k][1]
-              value = record[KEY_MAP[k][0]]
-              h[k]=case type
-                   when :string
-                     value.to_s
-                   when :array
-                     value.map {|v| v.to_s}
-                   else
-                     raise "Unknown value type: #{type}"
-                   end
+      begin
+        subscribe.each do |xml, message, string_inserts|
+          @parser.parse(xml) do |time, record|
+            # record.has_key?("EventData") for none parser checking.
+            if @winevt_xml
+              record["Description"] = message
+              record["EventData"] = string_inserts
+
+              h = {}
+              @keynames.each do |k|
+                type = KEY_MAP[k][1]
+                value = record[KEY_MAP[k][0]]
+                h[k]=case type
+                     when :string
+                       value.to_s
+                     when :array
+                       value.map {|v| v.to_s}
+                     else
+                       raise "Unknown value type: #{type}"
+                     end
+              end
+              parse_desc(h) if @parse_description
+              es.add(Fluent::Engine.now, h)
+            else
+              record["Description"] = message
+              record["EventData"] = string_inserts
+              # for none parser
+              es.add(Fluent::Engine.now, record)
             end
-            parse_desc(h) if @parse_description
-            es.add(Fluent::Engine.now, h)
-          else
-            record["Description"] = message
-            record["EventData"] = string_inserts
-            # for none parser
-            es.add(Fluent::Engine.now, record)
           end
         end
+      rescue Winevt::EventLog::Query::Error => e
+        log.warn "Invalid XML data", error: e
+        log.warn_backtrace
       end
       router.emit_stream(@tag, es)
       @bookmarks_storage.put(ch, subscribe.bookmark)
@@ -146,24 +151,29 @@ module Fluent::Plugin
 
     def on_notify_hash(ch, subscribe)
       es = Fluent::MultiEventStream.new
-      subscribe.each do |record, message, string_inserts|
-        record["Description"] = message
-        record["EventData"] = string_inserts
-        h = {}
-        @keynames.each do |k|
-          type = KEY_MAP[k][1]
-          value = record[KEY_MAP[k][0]]
-          h[k]=case type
-               when :string
-                 value.to_s
-               when :array
-                 value.map {|v| v.to_s}
-               else
-                 raise "Unknown value type: #{type}"
-               end
+      begin
+        subscribe.each do |record, message, string_inserts|
+          record["Description"] = message
+          record["EventData"] = string_inserts
+          h = {}
+          @keynames.each do |k|
+            type = KEY_MAP[k][1]
+            value = record[KEY_MAP[k][0]]
+            h[k]=case type
+                 when :string
+                   value.to_s
+                 when :array
+                   value.map {|v| v.to_s}
+                 else
+                   raise "Unknown value type: #{type}"
+                 end
+          end
+          parse_desc(h) if @parse_description
+          es.add(Fluent::Engine.now, h)
         end
-        parse_desc(h) if @parse_description
-        es.add(Fluent::Engine.now, h)
+      rescue Winevt::EventLog::Query::Error => e
+        log.warn "Invalid Hash data", error: e
+        log.warn_backtrace
       end
       router.emit_stream(@tag, es)
       @bookmarks_storage.put(ch, subscribe.bookmark)

data/test/plugin/test_in_windows_eventlog2.rb

@@ -58,7 +58,7 @@ DESC
     end
 
     assert(d.events.length >= 1)
-    event = d.events.last
+    event = d.events.select {|e| e.last["EventID"] == "65500" }.last
     record = event.last
 
     assert_equal("Application", record["Channel"])
@@ -114,7 +114,7 @@ DESC
       end
 
       assert(d.events.length >= 1)
-      event = d.events.last
+      event = d.events.select {|e| e.last["EventID"] == "65500" }.last
       record = event.last
 
       assert_false(d.instance.render_as_xml)
@@ -155,7 +155,7 @@ DESC
       end
 
       assert(d.events.length >= 1)
-      event = d.events.last
+      event = d.events.select {|e| e.last["EventID"] == "65500" }.last
       record = event.last
 
       prev_id = record["EventRecordID"].to_i

data/test/plugin/test_in_winevtlog.rb

@@ -38,7 +38,7 @@ class WindowsEventLogInputTest < Test::Unit::TestCase
     end
 
     assert(d.events.length >= 1)
-    event = d.events.last
+    event = d.events.select {|e| e.last["event_id"] == "65500" }.last
     record = event.last
     assert_equal("application", record["channel"])
     assert_equal("65500", record["event_id"])

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-windows-eventlog
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
 platform: ruby
 authors:
 - okahashi117
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-10-11 00:00:00.000000000 Z
+date: 2019-10-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler