hpess-logstash-codec-cef 0.1.4

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml ADDED
@@ -0,0 +1,7 @@
1
+ ---
2
+ SHA1:
3
+ metadata.gz: 5c93c2c3bb203fb5ab931e1765e067259312a95d
4
+ data.tar.gz: 3d121765f80193449bbd7418260af0a3ab5fd739
5
+ SHA512:
6
+ metadata.gz: f9bf4831867ee0a32ee9e3ee3cf3a736cf516bbf0d752391e143bdfde5ce2d7210d984faafbf48f16ac5fb47379f133fc410a81994dc01682d81895eac42ff21
7
+ data.tar.gz: fd3dd70a9613bd6899962ec07d698ba242e1b9611973f17ab6d454d20c27fbe7dfa663cd3493619c73084a2a464801845b38f607d41100fdf5a544a0a592b86a
data/.gitignore ADDED
@@ -0,0 +1,4 @@
1
+ build
2
+ vendor
3
+ tools
4
+ .VERSION.mk
data/CONTRIBUTORS ADDED
@@ -0,0 +1,17 @@
1
+ The following is a list of people who have contributed ideas, code, bug
2
+ reports, or in general have helped logstash along its way.
3
+
4
+ Contributors:
5
+ * Aaron Mildenstein (untergeek)
6
+ * Colin Surprenant (colinsurprenant)
7
+ * Jason Kendall (coolacid)
8
+ * Jordan Sissel (jordansissel)
9
+ * João Duarte (jsvd)
10
+ * Nick Ethier (nickethier)
11
+ * Pete Fritchman (fetep)
12
+ * Pier-Hugues Pellerin (ph)
13
+
14
+ Note: If you've sent us patches, bug reports, or otherwise contributed to
15
+ Logstash, and you aren't on the list above and want to be, please let us know
16
+ and we'll make sure you're here. Contributions from folks like you are what make
17
+ open source awesome.
data/Gemfile ADDED
@@ -0,0 +1,2 @@
1
+ source 'https://rubygems.org'
2
+ gemspec
data/LICENSE ADDED
@@ -0,0 +1,13 @@
1
+ Copyright (c) 2012-2015 Elasticsearch <http://www.elasticsearch.org>
2
+
3
+ Licensed under the Apache License, Version 2.0 (the "License");
4
+ you may not use this file except in compliance with the License.
5
+ You may obtain a copy of the License at
6
+
7
+ http://www.apache.org/licenses/LICENSE-2.0
8
+
9
+ Unless required by applicable law or agreed to in writing, software
10
+ distributed under the License is distributed on an "AS IS" BASIS,
11
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
+ See the License for the specific language governing permissions and
13
+ limitations under the License.
data/README.md ADDED
@@ -0,0 +1,86 @@
1
+ # Logstash Plugin
2
+
3
+ This is a plugin for [Logstash](https://github.com/elasticsearch/logstash).
4
+
5
+ It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.
6
+
7
+ ## Documentation
8
+
9
+ Logstash provides infrastructure to automatically generate documentation for this plugin. We use the asciidoc format to write documentation so any comments in the source code will be first converted into asciidoc and then into html. All plugin documentation are placed under one [central location](http://www.elasticsearch.org/guide/en/logstash/current/).
10
+
11
+ - For formatting code or config example, you can use the asciidoc `[source,ruby]` directive
12
+ - For more asciidoc formatting tips, see the excellent reference here https://github.com/elasticsearch/docs#asciidoc-guide
13
+
14
+ ## Need Help?
15
+
16
+ Need help? Try #logstash on freenode IRC or the logstash-users@googlegroups.com mailing list.
17
+
18
+ ## Developing
19
+
20
+ ### 1. Plugin Developement and Testing
21
+
22
+ #### Code
23
+ - To get started, you'll need JRuby with the Bundler gem installed.
24
+
25
+ - Create a new plugin or clone and existing from the GitHub [logstash-plugins](https://github.com/logstash-plugins) organization. We also provide [example plugins](https://github.com/logstash-plugins?query=example).
26
+
27
+ - Install dependencies
28
+ ```sh
29
+ bundle install
30
+ ```
31
+
32
+ #### Test
33
+
34
+ - Update your dependencies
35
+
36
+ ```sh
37
+ bundle install
38
+ ```
39
+
40
+ - Run tests
41
+
42
+ ```sh
43
+ bundle exec rspec
44
+ ```
45
+
46
+ ### 2. Running your unpublished Plugin in Logstash
47
+
48
+ #### 2.1 Run in a local Logstash clone
49
+
50
+ - Edit Logstash `Gemfile` and add the local plugin path, for example:
51
+ ```ruby
52
+ gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
53
+ ```
54
+ - Install plugin
55
+ ```sh
56
+ bin/plugin install --no-verify
57
+ ```
58
+ - Run Logstash with your plugin
59
+ ```sh
60
+ bin/logstash -e 'filter {awesome {}}'
61
+ ```
62
+ At this point any modifications to the plugin code will be applied to this local Logstash setup. After modifying the plugin, simply rerun Logstash.
63
+
64
+ #### 2.2 Run in an installed Logstash
65
+
66
+ You can use the same **2.1** method to run your plugin in an installed Logstash by editing its `Gemfile` and pointing the `:path` to your local plugin development directory or you can build the gem and install it using:
67
+
68
+ - Build your plugin gem
69
+ ```sh
70
+ gem build logstash-filter-awesome.gemspec
71
+ ```
72
+ - Install the plugin from the Logstash home
73
+ ```sh
74
+ bin/plugin install /your/local/plugin/logstash-filter-awesome.gem
75
+ ```
76
+ - Start Logstash and proceed to test the plugin
77
+
78
+ ## Contributing
79
+
80
+ All contributions are welcome: ideas, patches, documentation, bug reports, complaints, and even something you drew up on a napkin.
81
+
82
+ Programming is not a required skill. Whatever you've seen about open source and maintainers or community members saying "send patches or die" - you will not see that here.
83
+
84
+ It is more important to the community that you are able to contribute.
85
+
86
+ For more information about contributing, see the [CONTRIBUTING](https://github.com/elasticsearch/logstash/blob/master/CONTRIBUTING.md) file.
data/Rakefile ADDED
@@ -0,0 +1,7 @@
1
+ @files=[]
2
+
3
+ task :default do
4
+ system("rake -T")
5
+ end
6
+
7
+ require "logstash/devutils/rake"
@@ -0,0 +1,93 @@
1
+ require "logstash/codecs/base"
2
+
3
+ class LogStash::Codecs::CEF < LogStash::Codecs::Base
4
+ config_name "cef"
5
+
6
+
7
+ # Specify if the Syslog header will be expected
8
+ config :syslog, :validate => :boolean, :default => false
9
+
10
+ config :signature, :validate => :string, :default => "Logstash"
11
+ config :name, :validate => :string, :default => "Logstash"
12
+ config :sev, :validate => :number, :default => 6
13
+
14
+ config :fields, :validate => :array
15
+
16
+ public
17
+ def initialize(params={})
18
+ super(params)
19
+ end
20
+
21
+ public
22
+ def decode(data)
23
+ # Need to break out the headers, then return the headers as individual fields, and the extension to be processed by a filter (ie: KV)
24
+ # %{SYSLOGDATE} %{HOST} CEF:Version|Device Vendor|Device Product|Device Version|SignatureID|Name|Severity|Extension
25
+ event = LogStash::Event.new()
26
+ if @syslog
27
+ @logger.debug("Expecting SYSLOG headers")
28
+ event['syslog'], data = data.split('CEF:', 2)
29
+ # Since we have the syslog headers, lets pull them out first and put them into their own field to be handled
30
+ else
31
+ # We don't have syslog headers, so we just need to remove CEF:
32
+ data.sub! /^CEF:/, ''
33
+ end #if @syslog
34
+ # Default any CEF unknown fields to unknown
35
+ data.gsub! '||', ''
36
+
37
+ # Now, break out the rest of the headers
38
+ event['cef_version'], event['cef_vendor'], event['cef_product'], event['cef_device_version'], event['cef_sigid'], event['cef_name'], event['cef_severity'], event['message'] = data.scan /(?:[^\|\\]|\\.)+/
39
+ # Now, try to break out the Extension Dictionary
40
+ message=event['message']
41
+ if message.to_s.strip.length != 0
42
+ message = message.strip
43
+ message = message.split(/ ([\w\.]+)=/)
44
+
45
+ key, value = message.shift.split('=',2)
46
+ @logger.debug(message)
47
+ kv = Hash[*message]
48
+ @logger.debug(kv)
49
+ addKey(kv,key,value)
50
+ event.to_hash.merge!(Hash[kv.map{ |k,v| ["cef_ext_"+k,v] }])
51
+ end #
52
+ yield event
53
+ end
54
+
55
+ public
56
+ def encode(data)
57
+ # "CEF:0|Elasticsearch|Logstash|1.0|Signature|Name|Sev|"
58
+
59
+ # TODO: Need to check that fields are set!
60
+
61
+ # Signature, Name, and Sev should be set in the config, with ref to fields
62
+ # Should also probably set the fields sent
63
+ header = ["CEF:0", "Elasticsearch", "Logstash", "1.0", @signature, @name, @sev].join("|")
64
+ values = @fields.map {|name| get_value(name, data)}.join(" ")
65
+ # values = values.map {|k,v| "#{k}=#{v}"}.join(" ")
66
+ @on_event.call(header + " " + values + "\n")
67
+ end
68
+
69
+ private
70
+ def addKey(kv_keys, key, value)
71
+ if kv_keys.has_key?(key)
72
+ if kv_keys[key].is_a? Array
73
+ kv_keys[key].push(value)
74
+ else
75
+ kv_keys[key] = [kv_keys[key], value]
76
+ end
77
+ else
78
+ kv_keys[key] = value
79
+ end
80
+ end # addKey
81
+
82
+ private
83
+ def get_value(name, event)
84
+ val = event[name]
85
+ case val
86
+ when Hash
87
+ return name + "=" + val.to_json
88
+ else
89
+ return name + "=" + val
90
+ end
91
+ end
92
+
93
+ end
@@ -0,0 +1,6 @@
1
+ # encoding: utf-8
2
+ # The version of logstash.
3
+ LOGSTASH_VERSION = "1.4.1.dev"
4
+
5
+ # Note to authors: this should not include dashes because 'gem' barfs if
6
+ # you include a dash in the version string.
@@ -0,0 +1,27 @@
1
+ Gem::Specification.new do |s|
2
+
3
+ s.name = 'hpess-logstash-codec-cef'
4
+ s.version = '0.1.4'
5
+ s.licenses = ['Apache License (2.0)']
6
+ s.summary = "CEF codec to parse CEF formated logs"
7
+ s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
8
+ s.authors = ["Elasticsearch"]
9
+ s.email = 'info@elasticsearch.com'
10
+ s.homepage = "http://www.elasticsearch.org/guide/en/logstash/current/index.html"
11
+ s.require_paths = ["lib"]
12
+
13
+ # Files
14
+ s.files = `git ls-files`.split($\)
15
+
16
+ # Tests
17
+ s.test_files = s.files.grep(%r{^(test|spec|features)/})
18
+
19
+ # Special flag to let us know this is actually a logstash plugin
20
+ s.metadata = { "logstash_plugin" => "true", "logstash_group" => "codec" }
21
+
22
+ # Gem dependencies
23
+ s.add_runtime_dependency "logstash-core", '>= 1.4.0', '< 2.0.0'
24
+
25
+ s.add_development_dependency 'logstash-devutils'
26
+ end
27
+
@@ -0,0 +1,44 @@
1
+ # encoding: utf-8
2
+
3
+ require "logstash/devutils/rspec/spec_helper"
4
+ require "logstash/codecs/cef"
5
+ require "logstash/event"
6
+
7
+ describe LogStash::Codecs::CEF do
8
+ subject do
9
+ next LogStash::Codecs::CEF.new
10
+ end
11
+
12
+ context "#encode" do
13
+ it "should assert all header fields are present"
14
+ end
15
+
16
+ context "#decode" do
17
+ let (:message) { "CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|src=10.0.0.192 dst=12.121.122.82 spt=1232" }
18
+
19
+ it "should parse the cef header" do
20
+ subject.decode(message) do |e|
21
+ insist { e.is_a?(LogStash::Event) }
22
+ insist { e["cef_version"] } == "0"
23
+ insist { e["cef_vendor"] } == "security"
24
+ insist { e["cef_product"] } == "threatmanager"
25
+ insist { e["cef_device_version"] } == "1.0"
26
+ insist { e["cef_sigid"] } == "100"
27
+ insist { e["cef_name"] } == "trojan successfully stopped"
28
+ insist { e["cef_severity"] } == "10"
29
+ insist { e["message"] } == "src=10.0.0.192 dst=12.121.122.82 spt=1232"
30
+ end
31
+ end
32
+
33
+ it "should parse the cef body" do
34
+ subject.decode(message) do |e|
35
+ insist { e["cef_ext_src"] } == "10.0.0.192"
36
+ insist { e["cef_ext_dst"] } == "12.121.122.82"
37
+ insist { e["cef_ext_spt"] } == "1232"
38
+ end
39
+ end
40
+
41
+ it "should handle values in the body that contain spaces"
42
+ end
43
+
44
+ end
metadata ADDED
@@ -0,0 +1,92 @@
1
+ --- !ruby/object:Gem::Specification
2
+ name: hpess-logstash-codec-cef
3
+ version: !ruby/object:Gem::Version
4
+ version: 0.1.4
5
+ platform: ruby
6
+ authors:
7
+ - Elasticsearch
8
+ autorequire:
9
+ bindir: bin
10
+ cert_chain: []
11
+ date: 2015-04-02 00:00:00.000000000 Z
12
+ dependencies:
13
+ - !ruby/object:Gem::Dependency
14
+ name: logstash-core
15
+ requirement: !ruby/object:Gem::Requirement
16
+ requirements:
17
+ - - ">="
18
+ - !ruby/object:Gem::Version
19
+ version: 1.4.0
20
+ - - "<"
21
+ - !ruby/object:Gem::Version
22
+ version: 2.0.0
23
+ type: :runtime
24
+ prerelease: false
25
+ version_requirements: !ruby/object:Gem::Requirement
26
+ requirements:
27
+ - - ">="
28
+ - !ruby/object:Gem::Version
29
+ version: 1.4.0
30
+ - - "<"
31
+ - !ruby/object:Gem::Version
32
+ version: 2.0.0
33
+ - !ruby/object:Gem::Dependency
34
+ name: logstash-devutils
35
+ requirement: !ruby/object:Gem::Requirement
36
+ requirements:
37
+ - - ">="
38
+ - !ruby/object:Gem::Version
39
+ version: '0'
40
+ type: :development
41
+ prerelease: false
42
+ version_requirements: !ruby/object:Gem::Requirement
43
+ requirements:
44
+ - - ">="
45
+ - !ruby/object:Gem::Version
46
+ version: '0'
47
+ description: This gem is a logstash plugin required to be installed on top of the
48
+ Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not
49
+ a stand-alone program
50
+ email: info@elasticsearch.com
51
+ executables: []
52
+ extensions: []
53
+ extra_rdoc_files: []
54
+ files:
55
+ - ".gitignore"
56
+ - CONTRIBUTORS
57
+ - Gemfile
58
+ - LICENSE
59
+ - README.md
60
+ - Rakefile
61
+ - lib/logstash/codecs/cef.rb
62
+ - lib/logstash/version.rb
63
+ - logstash-codec-cef.gemspec
64
+ - spec/codecs/cef_spec.rb
65
+ homepage: http://www.elasticsearch.org/guide/en/logstash/current/index.html
66
+ licenses:
67
+ - Apache License (2.0)
68
+ metadata:
69
+ logstash_plugin: 'true'
70
+ logstash_group: codec
71
+ post_install_message:
72
+ rdoc_options: []
73
+ require_paths:
74
+ - lib
75
+ required_ruby_version: !ruby/object:Gem::Requirement
76
+ requirements:
77
+ - - ">="
78
+ - !ruby/object:Gem::Version
79
+ version: '0'
80
+ required_rubygems_version: !ruby/object:Gem::Requirement
81
+ requirements:
82
+ - - ">="
83
+ - !ruby/object:Gem::Version
84
+ version: '0'
85
+ requirements: []
86
+ rubyforge_project:
87
+ rubygems_version: 2.2.2
88
+ signing_key:
89
+ specification_version: 4
90
+ summary: CEF codec to parse CEF formated logs
91
+ test_files:
92
+ - spec/codecs/cef_spec.rb