fluent-plugin-windows-eventlog 0.9.2 → 0.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce765b8becd1cc7835d19f2f1b9e3e0b1da48467f26434295e041887a4d8d057
-  data.tar.gz: 59129a827b949a6db83ba01f6d03da41ae0923304fcc479aecc7b37127517835
+  metadata.gz: aee5a6fff0b05599c781dbb19b43ffd9487bb03a74ba69bbef1f0d20ff8eb0f1
+  data.tar.gz: e9176154815c7973a8ef90b4f5bf57f9be17ee5c8f1d5656d2247bc82b887b49
 SHA512:
-  metadata.gz: 74b3233cd11710c90c456e313d4f87ec0fcc5392bbb12761f8e62398aa8cda1b7ec6ae9cbbe5b4c74bb26be1e804c804a7eea6c8796887bd97924b768362e56f
-  data.tar.gz: 36e9a709f939d021e75ccc1723207b1dbb524aa2f5658aeefa319476a67d142e888518f037202934fbb2458006e77ce3269bd87572ca988457872aaf47cf6242
+  metadata.gz: accd4776c795d420558a6972199a05ac2ffe6e85851ed4c1b0fc4ece8d41e63c68f7be77805f9c606cb552799597c48ba45d3d16f7d4a03b583fb523afe67086
+  data.tar.gz: fed33969e72197fb43b6ca016c0d9cc98f993c767c757143f089f9605c3c311b1546aebb51dc8c4f22b28697333cb0cd1a9d758d233543a85d217afa536c1df7

data/.github/dependabot.yml

@@ -3,4 +3,21 @@ updates:
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
-      interval: 'weekly'
+      interval: 'monthly'
+    groups:
+      # PR: "Security update [package] from [old] to [new]"
+      # This PR should be merged in hurry
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - '*'
+
+      # PR: "Bump [package] from [old] to [new]"
+      # No need to be merged this PR in hurry. It is enough to merge
+      # once in a month.
+      monthly-updates:
+        applies-to: version-updates
+        patterns:
+          - '*'
+    # Allow to create PR both of security and normal updates.
+    open-pull-requests-limit: 1

data/.github/workflows/unit-test.yml

@@ -4,32 +4,34 @@ on:
     branches: [master]
   pull_request:
     branches: [master]
+  schedule:
+    - cron: '0 0 1 * *'
 jobs:
+  ruby-versions:
+    uses: ruby/actions/.github/workflows/ruby_versions.yml@master
+    with:
+      engine: cruby
+      min_version: 2.7
   test:
+    needs: ruby-versions
     runs-on: ${{ matrix.os }}
-    continue-on-error: ${{ matrix.experimental }}
+    continue-on-error: ${{ matrix.ruby == 'head' }}
     strategy:
       fail-fast: false
       matrix:
-        ruby: [ '3.4', '3.3', '3.2', '3.1', '3.0', '2.7' ]
+        ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }}
         os:
           - windows-latest
-        experimental: [false]
-        include:
-          - ruby: 'head'
-            os: windows-latest
-            experimental: true
     name: Ruby ${{ matrix.ruby }} on ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v5
-    - uses: ruby/setup-ruby@v1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: ${{ matrix.ruby }}
     - name: Install
       run: |
         ruby --version
         gem --version
-        gem install bundler rake
         ridk exec bundle install --jobs 4 --retry 3
     - name: Unit Test
       run: |

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+# Release v0.9.3 - 2026/09/07
+
+* in_windows_eventlog2: fix key handling in parse_desc (#135)
+
 # Release v0.9.2 - 2025/11/21
 
 * in_windows_eventlog2: remove unexpected spaces in parsing description (#121)

data/fluent-plugin-winevtlog.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "fluent-plugin-windows-eventlog"
-  spec.version       = "0.9.2"
+  spec.version       = "0.9.3"
   spec.authors       = ["okahashi117", "Hiroshi Hatake", "Masahiro Nakagawa"]
   spec.email         = ["naruki_okahashi@jbat.co.jp", "cosmo0920.oucc@gmail.com", "repeatedly@gmail.com"]
   spec.summary       = %q{Fluentd Input plugin to read windows event log.}

data/lib/fluent/plugin/in_windows_eventlog2.rb

@@ -39,6 +39,7 @@ module Fluent::Plugin
                "Version"           => ["Version",               :string],
                "Description"       => ["Description",           :string],
                "EventData"         => ["EventData",             :array]}
+    RESERVED_RECORD_KEYS = (KEY_MAP.keys + ["DescriptionTitle"]).freeze
 
     config_param :tag, :string
     config_param :read_interval, :time, default: 2
@@ -412,30 +413,34 @@ module Fluent::Plugin
         parent_key = nil
         elem.split(RECORD_DELIMITER).each { |r|
           key, value = if r.index(FIELD_DELIMITER)
-                         r.split(FIELD_DELIMITER)
+                         r.split(FIELD_DELIMITER, -1)
                        else
-                         r.split(NONE_FIELD_DELIMITER)
+                         r.split(NONE_FIELD_DELIMITER, -1)
                        end
-          key = "" if key.nil?
-          key.sub!(/:\s*$/, '')  # remove ':' from key
+          key = +"" if key.nil?
+          key.sub!(/:\s*\z/, '')  # remove ':' from key
+          k = parent_key.nil? ? to_key(key) : "#{parent_key}#{@description_key_delimiter}#{to_key(key)}"
+          taken = record.key?(k) || RESERVED_RECORD_KEYS.include?(k)
           if value.nil?
-            parent_key = to_key(key)
+            unless key.empty?
+              previous_key = taken ? nil : k
+              parent_key = to_key(key)
+            end
           else
             # parsed value sometimes contain unexpected "\t". So remove it.
             value.strip!
             # merge empty key values into the previous non-empty key record.
+            # XXX: This is for empty privileges record key.
+            # We should investigate whether an another case exists or not.
             if key.empty?
-              record[previous_key] = [record[previous_key], value].flatten.reject {|e| e.nil?}
-            elsif parent_key.nil?
-              record[to_key(key)] = value
+              record[previous_key] = [record[previous_key], value].flatten.reject {|e| e.nil?} if previous_key
+            elsif taken
+              previous_key = nil
             else
-              k = "#{parent_key}#{@description_key_delimiter}#{to_key(key)}"
               record[k] = value
+              previous_key = k
             end
           end
-          # XXX: This is for empty privileges record key.
-          # We should investigate whether an another case exists or not.
-          previous_key = to_key(key) unless key.empty?
         }
       }
     end

data/test/plugin/test_in_windows_eventlog2.rb

@@ -268,6 +268,177 @@ DESC
     assert_equal(expected, h)
   end
 
+  def test_parse_desc_keeps_event_metadata
+    d = create_driver(config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                  "parse_description" => true,
+                                                  "downcase_description_keys" => false
+                                                  }, [
+                                       config_element("storage", "", {
+                                                        '@type' => 'local',
+                                                        'persistent' => false
+                                                      }),
+                                     ]))
+    desc = [
+      "Creating Scriptblock text (1 of 1):",
+      "",
+      "Channel:\t\tSecurity",
+      "\tEventID:\t\t4624",
+      "\tComputer:\t\tDC01",
+    ].join("\r\n")
+    h = {"Channel"     => "Microsoft-Windows-PowerShell/Operational",
+         "EventID"     => "4104",
+         "Computer"    => "DESKTOP-FLUENTTEST",
+         "Description" => desc}
+    expected = {"Channel"          => "Microsoft-Windows-PowerShell/Operational",
+                "EventID"          => "4104",
+                "Computer"         => "DESKTOP-FLUENTTEST",
+                "DescriptionTitle" => "Creating Scriptblock text (1 of 1):"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_keeps_the_first_value_of_a_duplicated_key
+    d = create_driver
+    desc = [
+      "Special privileges assigned to new logon.",
+      "",
+      "Subject:",
+      "\tAccount Name:\t\tAdministrator",
+      "",
+      "Subject:",
+      "\tAccount Name:\t\tSYSTEM",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle"     => "Special privileges assigned to new logon.",
+                "subject.account_name" => "Administrator"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_does_not_merge_a_continuation_line_into_a_refused_key
+    d = create_driver
+    desc = [
+      "Special privileges assigned to new logon.",
+      "",
+      "Privileges:\t\tSeTcbPrivilege",
+      "",
+      "Privileges:\t\tSeDebugPrivilege",
+      "\t\tSeBackupPrivilege",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle" => "Special privileges assigned to new logon.",
+                "privileges"       => "SeTcbPrivilege"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_does_not_merge_a_continuation_line_into_an_existing_key
+    d = create_driver
+    desc = [
+      "Special privileges assigned to new logon.",
+      "",
+      "Privileges:\t\tSeTcbPrivilege",
+      "",
+      "Privileges:",
+      "\t\tSeDebugPrivilege",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle" => "Special privileges assigned to new logon.",
+                "privileges"       => "SeTcbPrivilege"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_keeps_event_metadata_reached_through_a_continuation_line
+    d = create_driver(config_element("ROOT", "", {"tag" => "fluent.eventlog",
+                                                  "parse_description" => true,
+                                                  "downcase_description_keys" => false
+                                                  }, [
+                                       config_element("storage", "", {
+                                                        '@type' => 'local',
+                                                        'persistent' => false
+                                                      }),
+                                     ]))
+    desc = [
+      "Creating Scriptblock text (1 of 1):",
+      "",
+      "Channel:",
+      "\t\t\tspoofed",
+    ].join("\r\n")
+    h = {"Channel"     => "Microsoft-Windows-PowerShell/Operational",
+         "Description" => desc}
+    expected = {"Channel"          => "Microsoft-Windows-PowerShell/Operational",
+                "DescriptionTitle" => "Creating Scriptblock text (1 of 1):"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_with_empty_field_value
+    d = create_driver
+    desc = [
+      "A service was installed in the system.",
+      "",
+      "Subject:",
+      "\tAccount Domain:\t\t",
+      "\tLogon ID:\t\t0x3E7",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle"       => "A service was installed in the system.",
+                "subject.account_domain" => "",
+                "subject.logon_id"       => "0x3E7"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_with_an_empty_record_in_a_group
+    d = create_driver
+    desc = [
+      "A service was installed in the system.",
+      "",
+      "Subject:",
+      "\t",
+      "\tLogon ID:\t\t0x3E7",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle" => "A service was installed in the system.",
+                "subject.logon_id" => "0x3E7"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_with_empty_field_value_after_a_single_tab
+    d = create_driver
+    desc = [
+      "A service was installed in the system.",
+      "",
+      "Subject:",
+      "\tService File Name:\t",
+      "\tLogon ID:\t\t0x3E7",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle"          => "A service was installed in the system.",
+                "subject.service_file_name" => "",
+                "subject.logon_id"          => "0x3E7"}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
+  def test_parse_desc_merges_a_continuation_line_into_the_nested_key
+    d = create_driver
+    desc = [
+      "Special privileges assigned to new logon.",
+      "",
+      "Subject:",
+      "\tAccount Name:\t\tAdministrator",
+      "\t\tsecond-value",
+    ].join("\r\n")
+    h = {"Description" => desc}
+    expected = {"DescriptionTitle"     => "Special privileges assigned to new logon.",
+                "subject.account_name" => ["Administrator", "second-value"]}
+    d.instance.parse_desc(h)
+    assert_equal(expected, h)
+  end
+
   def test_parse_privileges_description
     d = create_driver
     desc = ["Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-X-Y-ZZ\r\n\t",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-windows-eventlog
 version: !ruby/object:Gem::Version
-  version: 0.9.2
+  version: 0.9.3
 platform: ruby
 authors:
 - okahashi117
@@ -176,7 +176,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.18
 specification_version: 4
 summary: Fluentd Input plugin to read windows event log.
 test_files: