jls-grok 0.1.2786
Sign up to get free protection for your applications and to get access to all the features.
- data/INSTALL +12 -0
- data/ext/Grok.so +0 -0
- data/ext/Makefile +157 -0
- data/ext/extconf.rb +7 -0
- data/ext/mkmf.log +54 -0
- data/ext/rgrok.h +9 -0
- data/ext/ruby_grok.c +190 -0
- data/ext/ruby_grok.o +0 -0
- data/ext/ruby_grokmatch.c +220 -0
- data/ext/ruby_grokmatch.h +14 -0
- data/ext/ruby_grokmatch.o +0 -0
- data/lib/grok.rb +1 -0
- data/sample.rb +43 -0
- data/test/GDB_COMMAND +29 -0
- data/test/Makefile +7 -0
- data/test/alltests.rb +6 -0
- data/test/general/basic_test.rb +58 -0
- data/test/general/captures_test.rb +88 -0
- data/test/patterns/ip.input +10000 -0
- data/test/patterns/ip.rb +32 -0
- data/test/patterns/month.rb +25 -0
- data/test/patterns/number.rb +70 -0
- data/test/patterns/path.rb +32 -0
- data/test/patterns/quotedstring.rb +54 -0
- data/test/patterns/uri.rb +44 -0
- data/test/speedtest.rb +56 -0
- metadata +90 -0
data/sample.rb
ADDED
@@ -0,0 +1,43 @@
|
|
1
|
+
require "Grok"
|
2
|
+
require "pp"
|
3
|
+
|
4
|
+
patterns = {}
|
5
|
+
|
6
|
+
matches = [
|
7
|
+
#"%{SYSLOGBASE} Accepted %{NOTSPACE:method} for %{DATA:user} from %{IPORHOST:client} port %{INT:port}",
|
8
|
+
#"%{SYSLOGBASE} Did not receive identification string from %{IPORHOST:client}",
|
9
|
+
#"%{SYSLOGBASE} error: PAM: authentication error for %{DATA:user} from %{IPORHOST:client}",
|
10
|
+
"%{SYSLOGBASE} .*"
|
11
|
+
#"%{COMBINEDAPACHELOG}",
|
12
|
+
#"%{UNINDEXED}hello (?=%{GREEDYDATA})%{WORD}"
|
13
|
+
|
14
|
+
#"( *%{DATA:key}:%{NOTSPACE:value})+"
|
15
|
+
]
|
16
|
+
|
17
|
+
groks = matches.collect do |m|
|
18
|
+
g = Grok.new
|
19
|
+
g.add_patterns_from_file("../patterns/base")
|
20
|
+
g.compile(m)
|
21
|
+
g
|
22
|
+
end
|
23
|
+
|
24
|
+
bytes = 0
|
25
|
+
time_start = Time.now.to_f
|
26
|
+
$stdin.each do |line|
|
27
|
+
groks.each do |grok|
|
28
|
+
m = grok.match(line)
|
29
|
+
if m
|
30
|
+
#data = Hash.new { |h,k| h[k] = Array.new }
|
31
|
+
#m.each_capture do |key, value|
|
32
|
+
#data[key] << value
|
33
|
+
#end
|
34
|
+
#pp data
|
35
|
+
pp m.captures
|
36
|
+
#bytes += line.length
|
37
|
+
break
|
38
|
+
end
|
39
|
+
end
|
40
|
+
end
|
41
|
+
|
42
|
+
#time_end = Time.now.to_f
|
43
|
+
#puts "parse rate: #{ (bytes / 1024) / (time_end - time_start) }"
|
data/test/GDB_COMMAND
ADDED
@@ -0,0 +1,29 @@
|
|
1
|
+
set confirm off
|
2
|
+
delete
|
3
|
+
|
4
|
+
break rGrokMatch_new_from_grok_match if strcmp(gm->subject, "40079") == 0
|
5
|
+
commands
|
6
|
+
printf "subject: %s\n", gm->subject
|
7
|
+
delete
|
8
|
+
break rGrokMatch_captures
|
9
|
+
cont
|
10
|
+
end
|
11
|
+
|
12
|
+
set confirm off
|
13
|
+
delete
|
14
|
+
break rGrokMatch_new_from_grok_match if strcmp(gm->subject, "-29086") == 0
|
15
|
+
commands
|
16
|
+
print *gm
|
17
|
+
delete
|
18
|
+
break rGrokMatch_captures
|
19
|
+
cont
|
20
|
+
end
|
21
|
+
|
22
|
+
run
|
23
|
+
|
24
|
+
next
|
25
|
+
print *gm
|
26
|
+
print *(gm->grok)
|
27
|
+
delete
|
28
|
+
cont
|
29
|
+
|
data/test/Makefile
ADDED
data/test/alltests.rb
ADDED
@@ -0,0 +1,58 @@
|
|
1
|
+
#require 'rubygems'
|
2
|
+
require 'Grok'
|
3
|
+
require 'test/unit'
|
4
|
+
|
5
|
+
class GrokBasicTests < Test::Unit::TestCase
|
6
|
+
def setup
|
7
|
+
@grok = Grok.new
|
8
|
+
end
|
9
|
+
|
10
|
+
def test_grok_methods
|
11
|
+
assert_respond_to(@grok, :compile)
|
12
|
+
assert_respond_to(@grok, :match)
|
13
|
+
assert_respond_to(@grok, :expanded_pattern)
|
14
|
+
assert_respond_to(@grok, :pattern)
|
15
|
+
end
|
16
|
+
|
17
|
+
def test_grok_compile_fails_on_invalid_expressions
|
18
|
+
bad_regexps = ["[", "[foo", "?", "foo????", "(?-"]
|
19
|
+
bad_regexps.each do |regexp|
|
20
|
+
assert_raise ArgumentError do
|
21
|
+
@grok.compile(regexp)
|
22
|
+
end
|
23
|
+
end
|
24
|
+
end
|
25
|
+
|
26
|
+
def test_grok_compile_succeeds_on_valid_expressions
|
27
|
+
good_regexps = ["[hello]", "(test)", "(?:hello)", "(?=testing)"]
|
28
|
+
good_regexps.each do |regexp|
|
29
|
+
assert_nothing_raised do
|
30
|
+
@grok.compile(regexp)
|
31
|
+
end
|
32
|
+
end
|
33
|
+
end
|
34
|
+
|
35
|
+
def test_grok_pattern_is_same_as_compile_pattern
|
36
|
+
pattern = "Hello world"
|
37
|
+
@grok.compile(pattern)
|
38
|
+
assert_equal(pattern, @grok.pattern)
|
39
|
+
end
|
40
|
+
|
41
|
+
# TODO(sissel): Move this test to a separate test suite aimed
|
42
|
+
# at testing grok internals
|
43
|
+
def test_grok_expanded_pattern_works_correctly
|
44
|
+
@grok.add_pattern("test", "hello world")
|
45
|
+
@grok.compile("%{test}")
|
46
|
+
assert_equal("(?<0000>hello world)", @grok.expanded_pattern)
|
47
|
+
end
|
48
|
+
|
49
|
+
def test_grok_load_patterns_from_file
|
50
|
+
require 'tempfile'
|
51
|
+
fd = Tempfile.new("grok_test_patterns.XXXXX")
|
52
|
+
fd.puts "TEST \\d+"
|
53
|
+
fd.close
|
54
|
+
@grok.add_patterns_from_file(fd.path)
|
55
|
+
@grok.compile("%{TEST}")
|
56
|
+
assert_equal("(?<0000>\\d+)", @grok.expanded_pattern)
|
57
|
+
end
|
58
|
+
end
|
@@ -0,0 +1,88 @@
|
|
1
|
+
#require 'rubygems'
|
2
|
+
require 'Grok'
|
3
|
+
require 'test/unit'
|
4
|
+
|
5
|
+
class GrokPatternCapturingTests < Test::Unit::TestCase
|
6
|
+
def setup
|
7
|
+
@grok = Grok.new
|
8
|
+
end
|
9
|
+
|
10
|
+
def test_capture_methods
|
11
|
+
@grok.add_pattern("foo", ".*")
|
12
|
+
@grok.compile("%{foo}")
|
13
|
+
match = @grok.match("hello world")
|
14
|
+
assert_respond_to(match, :captures)
|
15
|
+
assert_respond_to(match, :start)
|
16
|
+
assert_respond_to(match, :end)
|
17
|
+
assert_respond_to(match, :subject)
|
18
|
+
assert_respond_to(match, :each_capture)
|
19
|
+
end
|
20
|
+
|
21
|
+
def test_basic_capture
|
22
|
+
@grok.add_pattern("foo", ".*")
|
23
|
+
@grok.compile("%{foo}")
|
24
|
+
input = "hello world"
|
25
|
+
match = @grok.match(input)
|
26
|
+
assert_equal("(?<0000>.*)", @grok.expanded_pattern)
|
27
|
+
assert_kind_of(GrokMatch, match)
|
28
|
+
assert_kind_of(Hash, match.captures)
|
29
|
+
assert_equal(match.captures.length, 1)
|
30
|
+
assert_kind_of(Array, match.captures["foo"])
|
31
|
+
assert_equal(1, match.captures["foo"].length)
|
32
|
+
assert_kind_of(String, match.captures["foo"][0])
|
33
|
+
assert_equal(input, match.captures["foo"][0])
|
34
|
+
|
35
|
+
assert_kind_of(Fixnum, match.start)
|
36
|
+
assert_kind_of(Fixnum, match.end)
|
37
|
+
assert_kind_of(String, match.subject)
|
38
|
+
assert_equal(0, match.start,
|
39
|
+
"Match of /.*/, start should equal 0")
|
40
|
+
assert_equal(input.length, match.end,
|
41
|
+
"Match of /.*/, end should equal input string length")
|
42
|
+
assert_equal(input, match.subject)
|
43
|
+
end
|
44
|
+
|
45
|
+
def test_multiple_captures_with_same_name
|
46
|
+
@grok.add_pattern("foo", "\\w+")
|
47
|
+
@grok.compile("%{foo} %{foo}")
|
48
|
+
match = @grok.match("hello world")
|
49
|
+
assert_not_equal(false, match)
|
50
|
+
assert_equal(1, match.captures.length)
|
51
|
+
assert_equal(2, match.captures["foo"].length)
|
52
|
+
assert_equal("hello", match.captures["foo"][0])
|
53
|
+
assert_equal("world", match.captures["foo"][1])
|
54
|
+
end
|
55
|
+
|
56
|
+
def test_multiple_captures
|
57
|
+
@grok.add_pattern("foo", "\\w+")
|
58
|
+
@grok.add_pattern("bar", "\\w+")
|
59
|
+
@grok.compile("%{foo} %{bar}")
|
60
|
+
match = @grok.match("hello world")
|
61
|
+
assert_not_equal(false, match)
|
62
|
+
assert_equal(2, match.captures.length)
|
63
|
+
assert_equal(1, match.captures["foo"].length)
|
64
|
+
assert_equal(1, match.captures["bar"].length)
|
65
|
+
assert_equal("hello", match.captures["foo"][0])
|
66
|
+
assert_equal("world", match.captures["bar"][0])
|
67
|
+
end
|
68
|
+
|
69
|
+
def test_nested_captures
|
70
|
+
@grok.add_pattern("foo", "\\w+ %{bar}")
|
71
|
+
@grok.add_pattern("bar", "\\w+")
|
72
|
+
@grok.compile("%{foo}")
|
73
|
+
match = @grok.match("hello world")
|
74
|
+
assert_not_equal(false, match)
|
75
|
+
assert_equal(2, match.captures.length)
|
76
|
+
assert_equal(1, match.captures["foo"].length)
|
77
|
+
assert_equal(1, match.captures["bar"].length)
|
78
|
+
assert_equal("hello world", match.captures["foo"][0])
|
79
|
+
assert_equal("world", match.captures["bar"][0])
|
80
|
+
end
|
81
|
+
|
82
|
+
def test_nesting_recursion
|
83
|
+
@grok.add_pattern("foo", "%{foo}")
|
84
|
+
assert_raises(ArgumentError) do
|
85
|
+
@grok.compile("%{foo}")
|
86
|
+
end
|
87
|
+
end
|
88
|
+
end
|