jls-grok 0.1.2786
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/INSTALL +12 -0
- data/ext/Grok.so +0 -0
- data/ext/Makefile +157 -0
- data/ext/extconf.rb +7 -0
- data/ext/mkmf.log +54 -0
- data/ext/rgrok.h +9 -0
- data/ext/ruby_grok.c +190 -0
- data/ext/ruby_grok.o +0 -0
- data/ext/ruby_grokmatch.c +220 -0
- data/ext/ruby_grokmatch.h +14 -0
- data/ext/ruby_grokmatch.o +0 -0
- data/lib/grok.rb +1 -0
- data/sample.rb +43 -0
- data/test/GDB_COMMAND +29 -0
- data/test/Makefile +7 -0
- data/test/alltests.rb +6 -0
- data/test/general/basic_test.rb +58 -0
- data/test/general/captures_test.rb +88 -0
- data/test/patterns/ip.input +10000 -0
- data/test/patterns/ip.rb +32 -0
- data/test/patterns/month.rb +25 -0
- data/test/patterns/number.rb +70 -0
- data/test/patterns/path.rb +32 -0
- data/test/patterns/quotedstring.rb +54 -0
- data/test/patterns/uri.rb +44 -0
- data/test/speedtest.rb +56 -0
- metadata +90 -0
data/sample.rb
ADDED
@@ -0,0 +1,43 @@
|
|
1
|
+
require "Grok"
|
2
|
+
require "pp"
|
3
|
+
|
4
|
+
patterns = {}
|
5
|
+
|
6
|
+
matches = [
|
7
|
+
#"%{SYSLOGBASE} Accepted %{NOTSPACE:method} for %{DATA:user} from %{IPORHOST:client} port %{INT:port}",
|
8
|
+
#"%{SYSLOGBASE} Did not receive identification string from %{IPORHOST:client}",
|
9
|
+
#"%{SYSLOGBASE} error: PAM: authentication error for %{DATA:user} from %{IPORHOST:client}",
|
10
|
+
"%{SYSLOGBASE} .*"
|
11
|
+
#"%{COMBINEDAPACHELOG}",
|
12
|
+
#"%{UNINDEXED}hello (?=%{GREEDYDATA})%{WORD}"
|
13
|
+
|
14
|
+
#"( *%{DATA:key}:%{NOTSPACE:value})+"
|
15
|
+
]
|
16
|
+
|
17
|
+
groks = matches.collect do |m|
|
18
|
+
g = Grok.new
|
19
|
+
g.add_patterns_from_file("../patterns/base")
|
20
|
+
g.compile(m)
|
21
|
+
g
|
22
|
+
end
|
23
|
+
|
24
|
+
bytes = 0
|
25
|
+
time_start = Time.now.to_f
|
26
|
+
$stdin.each do |line|
|
27
|
+
groks.each do |grok|
|
28
|
+
m = grok.match(line)
|
29
|
+
if m
|
30
|
+
#data = Hash.new { |h,k| h[k] = Array.new }
|
31
|
+
#m.each_capture do |key, value|
|
32
|
+
#data[key] << value
|
33
|
+
#end
|
34
|
+
#pp data
|
35
|
+
pp m.captures
|
36
|
+
#bytes += line.length
|
37
|
+
break
|
38
|
+
end
|
39
|
+
end
|
40
|
+
end
|
41
|
+
|
42
|
+
#time_end = Time.now.to_f
|
43
|
+
#puts "parse rate: #{ (bytes / 1024) / (time_end - time_start) }"
|
data/test/GDB_COMMAND
ADDED
@@ -0,0 +1,29 @@
|
|
1
|
+
set confirm off
|
2
|
+
delete
|
3
|
+
|
4
|
+
break rGrokMatch_new_from_grok_match if strcmp(gm->subject, "40079") == 0
|
5
|
+
commands
|
6
|
+
printf "subject: %s\n", gm->subject
|
7
|
+
delete
|
8
|
+
break rGrokMatch_captures
|
9
|
+
cont
|
10
|
+
end
|
11
|
+
|
12
|
+
set confirm off
|
13
|
+
delete
|
14
|
+
break rGrokMatch_new_from_grok_match if strcmp(gm->subject, "-29086") == 0
|
15
|
+
commands
|
16
|
+
print *gm
|
17
|
+
delete
|
18
|
+
break rGrokMatch_captures
|
19
|
+
cont
|
20
|
+
end
|
21
|
+
|
22
|
+
run
|
23
|
+
|
24
|
+
next
|
25
|
+
print *gm
|
26
|
+
print *(gm->grok)
|
27
|
+
delete
|
28
|
+
cont
|
29
|
+
|
data/test/Makefile
ADDED
data/test/alltests.rb
ADDED
@@ -0,0 +1,58 @@
|
|
1
|
+
#require 'rubygems'
|
2
|
+
require 'Grok'
|
3
|
+
require 'test/unit'
|
4
|
+
|
5
|
+
class GrokBasicTests < Test::Unit::TestCase
|
6
|
+
def setup
|
7
|
+
@grok = Grok.new
|
8
|
+
end
|
9
|
+
|
10
|
+
def test_grok_methods
|
11
|
+
assert_respond_to(@grok, :compile)
|
12
|
+
assert_respond_to(@grok, :match)
|
13
|
+
assert_respond_to(@grok, :expanded_pattern)
|
14
|
+
assert_respond_to(@grok, :pattern)
|
15
|
+
end
|
16
|
+
|
17
|
+
def test_grok_compile_fails_on_invalid_expressions
|
18
|
+
bad_regexps = ["[", "[foo", "?", "foo????", "(?-"]
|
19
|
+
bad_regexps.each do |regexp|
|
20
|
+
assert_raise ArgumentError do
|
21
|
+
@grok.compile(regexp)
|
22
|
+
end
|
23
|
+
end
|
24
|
+
end
|
25
|
+
|
26
|
+
def test_grok_compile_succeeds_on_valid_expressions
|
27
|
+
good_regexps = ["[hello]", "(test)", "(?:hello)", "(?=testing)"]
|
28
|
+
good_regexps.each do |regexp|
|
29
|
+
assert_nothing_raised do
|
30
|
+
@grok.compile(regexp)
|
31
|
+
end
|
32
|
+
end
|
33
|
+
end
|
34
|
+
|
35
|
+
def test_grok_pattern_is_same_as_compile_pattern
|
36
|
+
pattern = "Hello world"
|
37
|
+
@grok.compile(pattern)
|
38
|
+
assert_equal(pattern, @grok.pattern)
|
39
|
+
end
|
40
|
+
|
41
|
+
# TODO(sissel): Move this test to a separate test suite aimed
|
42
|
+
# at testing grok internals
|
43
|
+
def test_grok_expanded_pattern_works_correctly
|
44
|
+
@grok.add_pattern("test", "hello world")
|
45
|
+
@grok.compile("%{test}")
|
46
|
+
assert_equal("(?<0000>hello world)", @grok.expanded_pattern)
|
47
|
+
end
|
48
|
+
|
49
|
+
def test_grok_load_patterns_from_file
|
50
|
+
require 'tempfile'
|
51
|
+
fd = Tempfile.new("grok_test_patterns.XXXXX")
|
52
|
+
fd.puts "TEST \\d+"
|
53
|
+
fd.close
|
54
|
+
@grok.add_patterns_from_file(fd.path)
|
55
|
+
@grok.compile("%{TEST}")
|
56
|
+
assert_equal("(?<0000>\\d+)", @grok.expanded_pattern)
|
57
|
+
end
|
58
|
+
end
|
@@ -0,0 +1,88 @@
|
|
1
|
+
#require 'rubygems'
|
2
|
+
require 'Grok'
|
3
|
+
require 'test/unit'
|
4
|
+
|
5
|
+
class GrokPatternCapturingTests < Test::Unit::TestCase
|
6
|
+
def setup
|
7
|
+
@grok = Grok.new
|
8
|
+
end
|
9
|
+
|
10
|
+
def test_capture_methods
|
11
|
+
@grok.add_pattern("foo", ".*")
|
12
|
+
@grok.compile("%{foo}")
|
13
|
+
match = @grok.match("hello world")
|
14
|
+
assert_respond_to(match, :captures)
|
15
|
+
assert_respond_to(match, :start)
|
16
|
+
assert_respond_to(match, :end)
|
17
|
+
assert_respond_to(match, :subject)
|
18
|
+
assert_respond_to(match, :each_capture)
|
19
|
+
end
|
20
|
+
|
21
|
+
def test_basic_capture
|
22
|
+
@grok.add_pattern("foo", ".*")
|
23
|
+
@grok.compile("%{foo}")
|
24
|
+
input = "hello world"
|
25
|
+
match = @grok.match(input)
|
26
|
+
assert_equal("(?<0000>.*)", @grok.expanded_pattern)
|
27
|
+
assert_kind_of(GrokMatch, match)
|
28
|
+
assert_kind_of(Hash, match.captures)
|
29
|
+
assert_equal(match.captures.length, 1)
|
30
|
+
assert_kind_of(Array, match.captures["foo"])
|
31
|
+
assert_equal(1, match.captures["foo"].length)
|
32
|
+
assert_kind_of(String, match.captures["foo"][0])
|
33
|
+
assert_equal(input, match.captures["foo"][0])
|
34
|
+
|
35
|
+
assert_kind_of(Fixnum, match.start)
|
36
|
+
assert_kind_of(Fixnum, match.end)
|
37
|
+
assert_kind_of(String, match.subject)
|
38
|
+
assert_equal(0, match.start,
|
39
|
+
"Match of /.*/, start should equal 0")
|
40
|
+
assert_equal(input.length, match.end,
|
41
|
+
"Match of /.*/, end should equal input string length")
|
42
|
+
assert_equal(input, match.subject)
|
43
|
+
end
|
44
|
+
|
45
|
+
def test_multiple_captures_with_same_name
|
46
|
+
@grok.add_pattern("foo", "\\w+")
|
47
|
+
@grok.compile("%{foo} %{foo}")
|
48
|
+
match = @grok.match("hello world")
|
49
|
+
assert_not_equal(false, match)
|
50
|
+
assert_equal(1, match.captures.length)
|
51
|
+
assert_equal(2, match.captures["foo"].length)
|
52
|
+
assert_equal("hello", match.captures["foo"][0])
|
53
|
+
assert_equal("world", match.captures["foo"][1])
|
54
|
+
end
|
55
|
+
|
56
|
+
def test_multiple_captures
|
57
|
+
@grok.add_pattern("foo", "\\w+")
|
58
|
+
@grok.add_pattern("bar", "\\w+")
|
59
|
+
@grok.compile("%{foo} %{bar}")
|
60
|
+
match = @grok.match("hello world")
|
61
|
+
assert_not_equal(false, match)
|
62
|
+
assert_equal(2, match.captures.length)
|
63
|
+
assert_equal(1, match.captures["foo"].length)
|
64
|
+
assert_equal(1, match.captures["bar"].length)
|
65
|
+
assert_equal("hello", match.captures["foo"][0])
|
66
|
+
assert_equal("world", match.captures["bar"][0])
|
67
|
+
end
|
68
|
+
|
69
|
+
def test_nested_captures
|
70
|
+
@grok.add_pattern("foo", "\\w+ %{bar}")
|
71
|
+
@grok.add_pattern("bar", "\\w+")
|
72
|
+
@grok.compile("%{foo}")
|
73
|
+
match = @grok.match("hello world")
|
74
|
+
assert_not_equal(false, match)
|
75
|
+
assert_equal(2, match.captures.length)
|
76
|
+
assert_equal(1, match.captures["foo"].length)
|
77
|
+
assert_equal(1, match.captures["bar"].length)
|
78
|
+
assert_equal("hello world", match.captures["foo"][0])
|
79
|
+
assert_equal("world", match.captures["bar"][0])
|
80
|
+
end
|
81
|
+
|
82
|
+
def test_nesting_recursion
|
83
|
+
@grok.add_pattern("foo", "%{foo}")
|
84
|
+
assert_raises(ArgumentError) do
|
85
|
+
@grok.compile("%{foo}")
|
86
|
+
end
|
87
|
+
end
|
88
|
+
end
|