fluentd222 1.16.2-x86_64-linux

data/lib/fluent/plugin/compressable.rb

@@ -0,0 +1,96 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'stringio'
+require 'zlib'
+
+module Fluent
+  module Plugin
+    module Compressable
+      def compress(data, **kwargs)
+        output_io = kwargs[:output_io]
+        io = output_io || StringIO.new
+        Zlib::GzipWriter.wrap(io) do |gz|
+          gz.write data
+        end
+
+        output_io || io.string
+      end
+
+      # compressed_data is String like `compress(data1) + compress(data2) + ... + compress(dataN)`
+      # https://www.ruby-forum.com/topic/971591#979503
+      def decompress(compressed_data = nil, output_io: nil, input_io: nil)
+        case
+        when input_io && output_io
+          io_decompress(input_io, output_io)
+        when input_io
+          output_io = StringIO.new
+          io = io_decompress(input_io, output_io)
+          io.string
+        when compressed_data.nil? || compressed_data.empty?
+          # check compressed_data(String) is 0 length
+          compressed_data
+        when output_io
+          # execute after checking compressed_data is empty or not
+          io = StringIO.new(compressed_data)
+          io_decompress(io, output_io)
+        else
+          string_decompress(compressed_data)
+        end
+      end
+
+      private
+
+      def string_decompress(compressed_data)
+        io = StringIO.new(compressed_data)
+
+        out = ''
+        loop do
+          gz = Zlib::GzipReader.new(io)
+          out << gz.read
+          unused = gz.unused
+          gz.finish
+
+          unless unused.nil?
+            adjust = unused.length
+            io.pos -= adjust
+          end
+          break if io.eof?
+        end
+
+        out
+      end
+
+      def io_decompress(input, output)
+        loop do
+          gz = Zlib::GzipReader.new(input)
+          v = gz.read
+          output.write(v)
+          unused = gz.unused
+          gz.finish
+
+          unless unused.nil?
+            adjust = unused.length
+            input.pos -= adjust
+          end
+          break if input.eof?
+        end
+
+        output
+      end
+    end
+  end
+end

data/lib/fluent/plugin/exec_util.rb

@@ -0,0 +1,22 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/compat/exec_util'
+
+module Fluent
+  # obsolete
+  ExecUtil = Fluent::Compat::ExecUtil
+end

data/lib/fluent/plugin/file_util.rb

@@ -0,0 +1,22 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/compat/file_util'
+
+module Fluent
+  # obsolete
+  FileUtil = Fluent::Compat::FileUtil
+end

data/lib/fluent/plugin/filter.rb

@@ -0,0 +1,127 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/plugin/base'
+
+require 'fluent/event'
+require 'fluent/log'
+require 'fluent/plugin_id'
+require 'fluent/plugin_helper'
+
+module Fluent
+  module Plugin
+    class Filter < Base
+      include PluginId
+      include PluginLoggerMixin
+      include PluginHelper::Mixin
+
+      helpers_internal :event_emitter, :metrics
+
+      attr_reader :has_filter_with_time
+
+      def initialize
+        super
+        @has_filter_with_time = has_filter_with_time?
+        @emit_records_metrics = nil
+        @emit_size_metrics = nil
+        @counter_mutex = Mutex.new
+        @enable_size_metrics = false
+      end
+
+      def emit_records
+        @emit_records_metrics.get
+      end
+
+      def emit_size
+        @emit_size_metrics.get
+      end
+
+      def configure(conf)
+        super
+
+        @emit_records_metrics = metrics_create(namespace: "fluentd", subsystem: "filter", name: "emit_records", help_text: "Number of count emit records")
+        @emit_size_metrics = metrics_create(namespace: "fluentd", subsystem: "filter", name: "emit_size", help_text: "Total size of emit events")
+        @enable_size_metrics = !!system_config.enable_size_metrics
+      end
+
+      def statistics
+        stats = {
+          'emit_records' => @emit_records_metrics.get,
+          'emit_size' => @emit_size_metrics.get,
+        }
+
+        { 'filter' => stats }
+      end
+
+      def measure_metrics(es)
+        @emit_records_metrics.add(es.size)
+        @emit_size_metrics.add(es.to_msgpack_stream.bytesize) if @enable_size_metrics
+      end
+
+      def filter(tag, time, record)
+        raise NotImplementedError, "BUG: filter plugins MUST implement this method"
+      end
+
+      def filter_with_time(tag, time, record)
+        raise NotImplementedError, "BUG: filter plugins MUST implement this method"
+      end
+
+      def filter_stream(tag, es)
+        new_es = MultiEventStream.new
+        if @has_filter_with_time
+          es.each do |time, record|
+            begin
+              filtered_time, filtered_record = filter_with_time(tag, time, record)
+              new_es.add(filtered_time, filtered_record) if filtered_time && filtered_record
+            rescue => e
+              router.emit_error_event(tag, time, record, e)
+            end
+          end
+        else
+          es.each do |time, record|
+            begin
+              filtered_record = filter(tag, time, record)
+              new_es.add(time, filtered_record) if filtered_record
+            rescue => e
+              router.emit_error_event(tag, time, record, e)
+            end
+          end
+        end
+        new_es
+      end
+
+      private
+
+      def has_filter_with_time?
+        implmented_methods = self.class.instance_methods(false)
+        # Plugins that override `filter_stream` don't need check,
+        # because they may not call `filter` or `filter_with_time`
+        # for example fluentd/lib/fluent/plugin/filter_record_transformer.rb
+        return nil if implmented_methods.include?(:filter_stream)
+        case
+        when [:filter, :filter_with_time].all? { |e| implmented_methods.include?(e) }
+          raise "BUG: Filter plugins MUST implement either `filter` or `filter_with_time`"
+        when implmented_methods.include?(:filter)
+          false
+        when implmented_methods.include?(:filter_with_time)
+          true
+        else
+          raise NotImplementedError, "BUG: Filter plugins MUST implement either `filter` or `filter_with_time`"
+        end
+      end
+    end
+  end
+end

data/lib/fluent/plugin/filter_grep.rb

@@ -0,0 +1,189 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/plugin/filter'
+require 'fluent/config/error'
+require 'fluent/plugin/string_util'
+
+module Fluent::Plugin
+  class GrepFilter < Filter
+    Fluent::Plugin.register_filter('grep', self)
+
+    def initialize
+      super
+
+      @_regexp_and_conditions = nil
+      @_exclude_and_conditions = nil
+      @_regexp_or_conditions = nil
+      @_exclude_or_conditions = nil
+    end
+
+    # for test
+    attr_reader :_regexp_and_conditions, :_exclude_and_conditions, :_regexp_or_conditions, :_exclude_or_conditions
+
+    helpers :record_accessor
+
+    REGEXP_MAX_NUM = 20
+
+    (1..REGEXP_MAX_NUM).each {|i| config_param :"regexp#{i}",  :string, default: nil, deprecated: "Use <regexp> section" }
+    (1..REGEXP_MAX_NUM).each {|i| config_param :"exclude#{i}", :string, default: nil, deprecated: "Use <exclude> section" }
+
+    config_section :regexp, param_name: :regexps, multi: true do
+      desc "The field name to which the regular expression is applied."
+      config_param :key, :string
+      desc "The regular expression."
+      config_param :pattern, :regexp
+    end
+
+    config_section :exclude, param_name: :excludes, multi: true do
+      desc "The field name to which the regular expression is applied."
+      config_param :key, :string
+      desc "The regular expression."
+      config_param :pattern, :regexp
+    end
+
+    config_section :and, param_name: :and_conditions, multi: true do
+      config_section :regexp, param_name: :regexps, multi: true do
+        desc "The field name to which the regular expression is applied."
+        config_param :key, :string
+        desc "The regular expression."
+        config_param :pattern, :regexp
+      end
+      config_section :exclude, param_name: :excludes, multi: true do
+        desc "The field name to which the regular expression is applied."
+        config_param :key, :string
+        desc "The regular expression."
+        config_param :pattern, :regexp
+      end
+    end
+
+    config_section :or, param_name: :or_conditions, multi: true do
+      config_section :regexp, param_name: :regexps, multi: true do
+        desc "The field name to which the regular expression is applied."
+        config_param :key, :string
+        desc "The regular expression."
+        config_param :pattern, :regexp
+      end
+      config_section :exclude, param_name: :excludes, multi: true do
+        desc "The field name to which the regular expression is applied."
+        config_param :key, :string
+        desc "The regular expression."
+        config_param :pattern, :regexp
+      end
+    end
+
+    def configure(conf)
+      super
+
+      regexp_and_conditions = {}
+      regexp_or_conditions = {}
+      exclude_and_conditions = {}
+      exclude_or_conditions = {}
+
+      (1..REGEXP_MAX_NUM).each do |i|
+        next unless conf["regexp#{i}"]
+        key, regexp = conf["regexp#{i}"].split(/ /, 2)
+        raise Fluent::ConfigError, "regexp#{i} does not contain 2 parameters" unless regexp
+        raise Fluent::ConfigError, "regexp#{i} contains a duplicated key, #{key}" if regexp_and_conditions[key]
+        regexp_and_conditions[key] = Expression.new(record_accessor_create(key), Regexp.compile(regexp))
+      end
+
+      (1..REGEXP_MAX_NUM).each do |i|
+        next unless conf["exclude#{i}"]
+        key, exclude = conf["exclude#{i}"].split(/ /, 2)
+        raise Fluent::ConfigError, "exclude#{i} does not contain 2 parameters" unless exclude
+        raise Fluent::ConfigError, "exclude#{i} contains a duplicated key, #{key}" if exclude_or_conditions[key]
+        exclude_or_conditions[key] = Expression.new(record_accessor_create(key), Regexp.compile(exclude))
+      end
+
+      if @regexps.size > 1
+        log.info "Top level multiple <regexp> is interpreted as 'and' condition"
+      end
+      @regexps.each do |e|
+        raise Fluent::ConfigError, "Duplicate key: #{e.key}" if regexp_and_conditions.key?(e.key)
+        regexp_and_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
+      end
+
+      if @excludes.size > 1
+        log.info "Top level multiple <exclude> is interpreted as 'or' condition"
+      end
+      @excludes.each do |e|
+        raise Fluent::ConfigError, "Duplicate key: #{e.key}" if exclude_or_conditions.key?(e.key)
+        exclude_or_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
+      end
+
+      @and_conditions.each do |and_condition|
+        if !and_condition.regexps.empty? && !and_condition.excludes.empty?
+          raise Fluent::ConfigError, "Do not specify both <regexp> and <exclude> in <and>"
+        end
+        and_condition.regexps.each do |e|
+          raise Fluent::ConfigError, "Duplicate key in <and>: #{e.key}" if regexp_and_conditions.key?(e.key)
+          regexp_and_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
+        end
+        and_condition.excludes.each do |e|
+          raise Fluent::ConfigError, "Duplicate key in <and>: #{e.key}" if exclude_and_conditions.key?(e.key)
+          exclude_and_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
+        end
+      end
+
+      @or_conditions.each do |or_condition|
+        if !or_condition.regexps.empty? && !or_condition.excludes.empty?
+          raise Fluent::ConfigError, "Do not specify both <regexp> and <exclude> in <or>"
+        end
+        or_condition.regexps.each do |e|
+          raise Fluent::ConfigError, "Duplicate key in <or>: #{e.key}" if regexp_or_conditions.key?(e.key)
+          regexp_or_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
+        end
+        or_condition.excludes.each do |e|
+          raise Fluent::ConfigError, "Duplicate key in <or>: #{e.key}" if exclude_or_conditions.key?(e.key)
+          exclude_or_conditions[e.key] = Expression.new(record_accessor_create(e.key), e.pattern)
+        end
+      end
+
+      @_regexp_and_conditions = regexp_and_conditions.values unless regexp_and_conditions.empty?
+      @_exclude_and_conditions = exclude_and_conditions.values unless exclude_and_conditions.empty?
+      @_regexp_or_conditions = regexp_or_conditions.values unless regexp_or_conditions.empty?
+      @_exclude_or_conditions = exclude_or_conditions.values unless exclude_or_conditions.empty?
+    end
+
+    def filter(tag, time, record)
+      begin
+        if @_regexp_and_conditions && @_regexp_and_conditions.any? { |expression| !expression.match?(record) }
+          return nil
+        end
+        if @_regexp_or_conditions && @_regexp_or_conditions.none? { |expression| expression.match?(record) }
+          return nil
+        end
+        if @_exclude_and_conditions && @_exclude_and_conditions.all? { |expression| expression.match?(record) }
+          return nil
+        end
+        if @_exclude_or_conditions && @_exclude_or_conditions.any? { |expression| expression.match?(record) }
+          return nil
+        end
+      rescue => e
+        log.warn "failed to grep events", error: e
+        log.warn_backtrace
+      end
+      record
+    end
+
+    Expression = Struct.new(:key, :pattern) do
+      def match?(record)
+        ::Fluent::StringUtil.match_regexp(pattern, key.call(record).to_s)
+      end
+    end
+  end
+end

data/lib/fluent/plugin/filter_parser.rb

@@ -0,0 +1,130 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/time'
+require 'fluent/config/error'
+require 'fluent/plugin/filter'
+require 'fluent/plugin_helper/parser'
+require 'fluent/plugin_helper/compat_parameters'
+
+module Fluent::Plugin
+  class ParserFilter < Filter
+    Fluent::Plugin.register_filter('parser', self)
+
+    helpers :parser, :record_accessor, :compat_parameters
+
+    desc 'Specify field name in the record to parse.'
+    config_param :key_name, :string
+    desc 'Keep original key-value pair in parsed result.'
+    config_param :reserve_data, :bool, default: false
+    desc 'Keep original event time in parsed result.'
+    config_param :reserve_time, :bool, default: false
+    desc 'Remove "key_name" field from the record when parsing is succeeded'
+    config_param :remove_key_name_field, :bool, default: false
+    desc 'Store parsed values with specified key name prefix.'
+    config_param :inject_key_prefix, :string, default: nil
+    desc 'If true, invalid string is replaced with safe characters and re-parse it.'
+    config_param :replace_invalid_sequence, :bool, default: false
+    desc 'Store parsed values as a hash value in a field.'
+    config_param :hash_value_field, :string, default: nil
+    desc 'Emit invalid record to @ERROR label'
+    config_param :emit_invalid_record_to_error, :bool, default: true
+
+    attr_reader :parser
+
+    def configure(conf)
+      compat_parameters_convert(conf, :parser)
+
+      super
+
+      @accessor = record_accessor_create(@key_name)
+      @parser = parser_create
+    end
+
+    FAILED_RESULT = [nil, nil].freeze # reduce allocation cost
+    REPLACE_CHAR = '?'.freeze
+
+    def filter_with_time(tag, time, record)
+      raw_value = @accessor.call(record)
+      if raw_value.nil?
+        if @emit_invalid_record_to_error
+          router.emit_error_event(tag, time, record, ArgumentError.new("#{@key_name} does not exist"))
+        end
+        if @reserve_data
+          return time, handle_parsed(tag, record, time, {})
+        else
+          return FAILED_RESULT
+        end
+      end
+      begin
+        @parser.parse(raw_value) do |t, values|
+          if values
+            t = if @reserve_time
+                  time
+                else
+                  t.nil? ? time : t
+                end
+            @accessor.delete(record) if @remove_key_name_field
+            r = handle_parsed(tag, record, t, values)
+            return t, r
+          else
+            if @emit_invalid_record_to_error
+              router.emit_error_event(tag, time, record, Fluent::Plugin::Parser::ParserError.new("pattern not matched with data '#{raw_value}'"))
+            end
+            if @reserve_data
+              t = time
+              r = handle_parsed(tag, record, time, {})
+              return t, r
+            else
+              return FAILED_RESULT
+            end
+          end
+        end
+      rescue Fluent::Plugin::Parser::ParserError => e
+        if @emit_invalid_record_to_error
+          raise e
+        else
+          return FAILED_RESULT
+        end
+      rescue ArgumentError => e
+        raise unless @replace_invalid_sequence
+        raise unless e.message.index("invalid byte sequence in") == 0
+
+        raw_value = raw_value.scrub(REPLACE_CHAR)
+        retry
+      rescue => e
+        if @emit_invalid_record_to_error
+          raise Fluent::Plugin::Parser::ParserError, "parse failed #{e.message}"
+        else
+          return FAILED_RESULT
+        end
+      end
+    end
+
+    private
+
+    def handle_parsed(tag, record, t, values)
+      if values && @inject_key_prefix
+        values = Hash[values.map { |k, v| [@inject_key_prefix + k, v] }]
+      end
+      r = @hash_value_field ? {@hash_value_field => values} : values
+      if @reserve_data
+        r = r ? record.merge(r) : record
+      end
+      r
+    end
+  end
+end