logstash-codec-cloudtrail 3.0.4 → 3.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 90d24178bcbdfb7bcd6b7be4a1de10b2dbc4b98c623d274ca2bc1271b4f4a639
-  data.tar.gz: 2e6841d6c506b4f2c2048c61bbdda81ff5449a509cbd3c85d072ecd6630c0d40
+  metadata.gz: 8facb9d38254e7833e0404a8bbe793caba2270a1b619b967fb38de5e293e4006
+  data.tar.gz: 2ae2347e0661a502c6502a28871e2f57eaba1053f67afbcf313b390ebe2ad4d9
 SHA512:
-  metadata.gz: 88cdb1d49878f3fd09b6a58d580a1ba212ff2dc1dc9c404024ef74e9344ca6f1657c8fccf73504b4cc68f4f389ecae8371ff9a454605627c34a6356c22ae33ee
-  data.tar.gz: 78ff4cd11692939de1a54d1e9881d2487d71f51fe1ba3c0036562146f6792234973b4cefbb8cad15841e46c76d9214083545110511b2b9e3d46c8db6e446bba1
+  metadata.gz: 722f690e8dbb517177bfe682147bf4506db942191919e6f2ed4fd9b994bcce7e4cdc5d9424ca885e96f203c6ad832f7d3c9ed7c2219fdcbcc39b53c1fa035894
+  data.tar.gz: 938ed97d6ceff25a073547230daa40ae00fd440371ed09bd3760cc7b76e77277e135da81485622a2dcb13273ba3233306eb19a91cfb98eae15b6cf6b820ffc66

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 3.0.5
+  - [#22](https://github.com/logstash-plugins/logstash-codec-cloudtrail/pull/22)Handle 'sourceIpAddress' fields with non-ip address content by moving them to 'sourceHost' field
+
 ## 3.0.4
   - Don't crash when data doesn't contain some particular elements
 

data/lib/logstash/codecs/cloudtrail.rb

@@ -28,8 +28,20 @@ class LogStash::Codecs::CloudTrail < LogStash::Codecs::Base
         end
       end
 
+      substitute_invalid_ip_address(event)
+
       yield LogStash::Event.new(event)
     end
   end # def decode
 
+  # Workaround for https://github.com/logstash-plugins/logstash-codec-cloudtrail/issues/20
+  # API calls from support will fill the sourceIpAddress with a hostname string instead of an ip
+  # address.
+  def substitute_invalid_ip_address(event)
+    source_ip_address = event["sourceIpAddress"]
+    if source_ip_address && source_ip_address !~ Resolv::IPv4::Regex && source_ip_address !~ Resolv::IPv6::Regex
+      event["sourceHost"] = event.delete("sourceIpAddress")
+    end
+  end
+
 end # class LogStash::Codecs::CloudTrail

data/logstash-codec-cloudtrail.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-codec-cloudtrail'
-  s.version         = '3.0.4'
+  s.version         = '3.0.5'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Process AWS CloudTrail formatted messages"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

data/spec/codecs/cloudtrail_spec.rb

@@ -1,9 +1,21 @@
 require "logstash/devutils/rspec/spec_helper"
 require "logstash/plugin"
 require "logstash/codecs/cloudtrail"
+require 'resolv'
 
 describe LogStash::Codecs::CloudTrail do
 
+  shared_examples_for "it handles valid ip addresses" do
+    it 'should pass through valid ip addresses' do
+      ip_addresses.each do |valid_ip_address|
+        subject.decode("{\"Records\":[{\"sourceIpAddress\":\"#{valid_ip_address}\"}]}") do |event|
+          expect(event.get("sourceIpAddress")).to eq(valid_ip_address)
+          expect(event.get("sourceHost")).to be_nil
+        end
+      end
+    end
+  end
+
   describe '#decode' do
     it 'accepts data without a Records property' do
       expect { |b|
@@ -16,5 +28,29 @@ describe LogStash::Codecs::CloudTrail do
         subject.decode('{"Records":[{"requestParameters":null}]}', &b)
       }.to yield_control
     end
+
+    context 'with ipv4 sourceIpAddress values' do
+      let(:ip_addresses) { ["127.0.0.1", "8.8.8.8", "10.10.10.10", "100.100.100.100", "1.12.123.234"] }
+      it_behaves_like 'it handles valid ip addresses'
+    end
+
+    context 'with ipv6 sourceIpAddress values' do
+      let(:ip_addresses) { ["2001:0db8:85a3:0000:0000:8a2e:0370:7334", "2001:db8:85a3::8a2e:370:7334", "::1", "::"] }
+      it_behaves_like 'it handles valid ip addresses'
+    end
+
+    it 'accepts records with an invalid sourceIpAddress' do
+      subject.decode('{"Records":[{"sourceIpAddress":"www.elastic.co"}]}') do |event|
+        expect(event.get("sourceIpAddress")).to be_nil
+        expect(event.get("sourceHost")).to eq("www.elastic.co")
+      end
+    end
+
+    it 'accepts records with a no sourceIpAddress' do
+      subject.decode('{"Records":[{"sourceIpAddress":null}]}') do |event|
+        expect(event.get("sourceIpAddress")).to be_nil
+        expect(event.get("sourceHost")).to be_nil
+      end
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-codec-cloudtrail
 version: !ruby/object:Gem::Version
-  version: 3.0.4
+  version: 3.0.5
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-03-12 00:00:00.000000000 Z
+date: 2018-06-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement