hpess-logstash-codec-cef 0.1.6 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 82aeade6d1d9b90d7989cd8a9e4d949c8a151d73
-  data.tar.gz: 9245659333045632c105bb6fd6a59d46a3a8df57
+  metadata.gz: 57330ab16e56eb40f97c35161a31a89ef0a53db1
+  data.tar.gz: 279a1861c849597fa62833fb3bcb674dfd913c51
 SHA512:
-  metadata.gz: 14621f3d0cea8d03006f81a4ce453a1adfc7e9e8cff23231090574b4be0da8215f297ab53be0765d1be6bdf123d0fd93ae59a7ca4ffccf537547d414969fca10
-  data.tar.gz: ed5045e928c7c15e08b59adaf5ad0f52df9841f8be3a88c3123f5fff77058943b8245ece880d7a7b5f01db923203ad4eb88f359715cc3d026c60befd349e3717
+  metadata.gz: ca205a4e25ec02147459e40d90608b861a4b308c33bab64b400c9bfee6637bb7cf55e265ffaa3b16480f968dc1cd3c99a50d47c9dffc29a10f8b233bf0a1b737
+  data.tar.gz: eb5375a8477c2a1f8c74e9a0c8c6ea7535d8190e5a86bee7782d20d8e8e599acdd6fe7a047e2458a1a4b229fe20ef114ac96d9d2b1c2e9473a03cbab8cdd2f3b

data/lib/logstash/codecs/cef.rb

@@ -2,7 +2,6 @@ require "logstash/codecs/base"
 
 class LogStash::Codecs::CEF < LogStash::Codecs::Base
   config_name "cef"
-  config :syslog, :validate => :boolean, :default => false
   config :signature, :validate => :string, :default => "Logstash"
   config :name, :validate => :string, :default => "Logstash"
   config :sev, :validate => :number, :default => 6
@@ -18,33 +17,27 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
   def decode(data)
     # %{SYSLOGDATE} %{HOST} CEF:Version|Device Vendor|Device Product|Device Version|SignatureID|Name|Severity|Extension
     event = LogStash::Event.new()
-    if @syslog
-      @logger.debug("Expecting SYSLOG headers")
-      event['syslog'], data = data.split('CEF:', 2)
-      # Since we have the syslog headers, lets pull them out first and put them into their own field to be handled
-    else 
-      # We don't have syslog headers, so we just need to remove CEF:
-      data.sub! /^CEF:/, ''
-    end 
+    event['syslog'], data = data.split('CEF:', 2) if not data.index('CEF:') == 0
+    data.sub! /^CEF:/, ''
+    event['cef_version'], event['cef_vendor'], event['cef_product'], event['cef_device_version'], event['cef_sigid'], event['cef_name'], event['cef_severity'], message = data.split /(?<!\\)[\|]/
 
-    # Get the headers
-    event['cef_version'], event['cef_vendor'], event['cef_product'], event['cef_device_version'], event['cef_sigid'], event['cef_name'], event['cef_severity'], event['message'] =  data.split /(?<!\\)[\|]/
+    # Strip any whitespace from the message
+    message = message.to_s.strip
 
-    # Strip any whitespace from the message 
-    message=event['message'].to_s.strip
-    event['message']=message
-
-    # Now, try to break out the Extension Dictionary
-    if message.length != 0
+    # Now parse the key value pairs into it
+    extensions = {}
+    if message.length != 0 and message.include? "="
       message = message.split(/ ([\w\.]+)=/)
+      key, value = message.shift.split('=', 2)
+      extensions[key] = value
+      
+      Hash[*message].each{|k, v| 
+        extensions[k] = v
+      }
 
-      key, value = message.shift.split('=',2)
-      @logger.debug(message)
-      kv = Hash[*message]
-      @logger.debug(kv)
-      addKey(kv,key,value)
-      event.to_hash.merge!(Hash[kv.map{ |k,v| ["cef_ext_"+k,v] }])
-    end #
+      # And save the new has as the extensions
+      event['cef_extension'] = extensions
+    end
     yield event
   end
 
@@ -62,19 +55,6 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
     @on_event.call(header + " " + values + "\n")
   end
 
-  private
-  def addKey(kv_keys, key, value)
-    if kv_keys.has_key?(key)
-      if kv_keys[key].is_a? Array
-        kv_keys[key].push(value)
-      else
-        kv_keys[key] = [kv_keys[key], value]
-      end
-    else
-      kv_keys[key] = value
-    end
-  end # addKey
-
   private
   def get_value(name, event)
     val = event[name]

data/logstash-codec-cef.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'hpess-logstash-codec-cef'
-  s.version         = '0.1.6'
+  s.version         = '0.2.0'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "CEF codec to parse CEF formated logs"
   s.description     = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"

data/spec/codecs/cef_spec.rb

@@ -18,17 +18,17 @@ describe LogStash::Codecs::CEF do
 
         def validate(e) 
             insist { e.is_a?(LogStash::Event) }
-            insist { e["cef_version"] } == "0"
-            insist { e["cef_device_version"] } == "1.0"
-            insist { e["cef_sigid"] } == "100"
-            insist { e["cef_name"] } == "trojan successfully stopped"
-            insist { e["cef_severity"] } == "10"
-            insist { e["message"] } == "src=10.0.0.192 dst=12.121.122.82 spt=1232"
+            insist { e['cef_version'] } == "0"
+            insist { e['cef_device_version'] } == "1.0"
+            insist { e['cef_sigid'] } == "100"
+            insist { e['cef_name'] } == "trojan successfully stopped"
+            insist { e['cef_severity'] } == "10"
         end
 
         it "should parse the cef headers" do
             subject.decode(message) do |e|
                 validate(e)
+                ext = e['cef_extension']
                 insist { e["cef_vendor"] } == "security"
                 insist { e["cef_product"] } == "threatmanager"
             end
@@ -36,9 +36,10 @@ describe LogStash::Codecs::CEF do
 
         it "should parse the cef body" do
             subject.decode(message) do |e|
-                insist { e["cef_ext_src"] } == "10.0.0.192"
-                insist { e["cef_ext_dst"] } == "12.121.122.82"
-                insist { e["cef_ext_spt"] } == "1232"
+                ext = e['cef_extension']
+                insist { ext['src'] } == "10.0.0.192"
+                insist { ext['dst'] } == "12.121.122.82"
+                insist { ext['spt'] } == "1232"
             end
         end
 
@@ -51,18 +52,26 @@ describe LogStash::Codecs::CEF do
             end 
         end
 
-        let (:leading_whitespace) { "CEF:0|security|threatmaager|1.0|100|trojan successfully stopped|10| src=10.0.0.192 dst=12.121.122.82 spt=1232" }
+        let (:leading_whitespace) { "CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10| src=10.0.0.192 dst=12.121.122.82 spt=1232" }
         it "should strip leading whitespace from the message" do
             subject.decode(leading_whitespace) do |e|
                 validate(e)
             end 
         end
 
-
-        let (:escaped_pipes) { 'CEF:0|||1.0|100|trojan successfully stopped|10|moo=this\|has an escaped pipe' }
+        let (:escaped_pipes) { 'CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|moo=this\|has an escaped pipe' }
         it "should be OK with escaped pipes in the message" do
             subject.decode(escaped_pipes) do |e|
-                insist { e["message"] } == 'moo=this\|has an escaped pipe'
+                ext = e['cef_extension']
+                insist { ext['moo'] } == 'this\|has an escaped pipe'
+            end 
+        end
+
+        let (:syslog) { "Syslogdate Sysloghost CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|src=10.0.0.192 dst=12.121.122.82 spt=1232" }
+        it "Should detect headers before CEF starts" do
+            subject.decode(syslog) do |e|
+                validate(e)
+                insist { e['syslog'] } == 'Syslogdate Sysloghost '
             end 
         end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hpess-logstash-codec-cef
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.2.0
 platform: ruby
 authors:
 - Elasticsearch