logstash-codec-mtrraw 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d88e82a64b32f90104a3e416cec993d4a72335b4
-  data.tar.gz: 99542d614c33bedbe63b114c1163f7bdd2ae1d1f
+  metadata.gz: 587994befbb0dc6d11a87ad54846eabd7c814de6
+  data.tar.gz: aa5ef5ca1baa6e64aa275c6ae55c38e7d2edf095
 SHA512:
-  metadata.gz: 21b9f69b4dcc2dc982b2ea9b4fa30a684992776294210c5ed5bbb7f82a6484507dc05342db5e50cb960ab5db2c0347ab9c59973106e559e7959cb46e5f8b3cfc
-  data.tar.gz: cb1badb8fc189389e7a68552de80e970477107cbad5a3bec6635738b31a60f98cf52552ba356479dbccf0882ce563caada82b07305896a4b5efe0b6f9a0ef7f3
+  metadata.gz: a5fdaedbecf58eb488a62ec062b5264fcc1e9388aa86048514fc8d98fae093b80d0fb76ebfbe5f7eb79ea07df6703f9b90d2722b33e0167512b5bf43051e71d7
+  data.tar.gz: adc61e20578251b28c136a8d81401d02913e393f9b4a886cf4ab5782b5ec0e02cd091a69b13862d5c4e7ae12120683182d5e876401faad988d649aac9bfc060a

data/README.md

@@ -28,12 +28,15 @@ input {
 Feed it with something that's functionally equivalent to this:
 
 ```
-while true ; do (echo "s 0 GOOGDNS 1";mtr --raw --no-dns  -c 1 8.8.8.8 ) | awk '{printf $0";"}'  | nc localhost 4327 ; done
+while true ; do (echo "s 0 MYBOX GOOGDNS 1";mtr --raw --no-dns  -c 1 8.8.8.8 ) | awk '{printf $0";"}'  | nc localhost 4327 ; done
 ```
 
 Put the above in a script, make the script executable, and run it in the background.  It'll continuously feed mtr trace data to
 the codec.
 
+The `agent` subdirectory contains some examples of this.  You may have to play around with paths etc to make it work on your
+system.
+
 Explanation:
 
 There's an infinite loop around the traces without a pause.  A pause isn't really needed to keep load down as the trace is i/o bound
@@ -43,14 +46,14 @@ The `(echo ...;mtr)` construct allows us to overload the frontend of the trace a
 stream.  The front of the trace has a line that looks like this:
 
 ```
-s 0 <targetname> <pingcount>
+s 0 <originname> <targetname> <pingcount>
 
 ```
 
+* <originname> is a name for the starting point of the trace
 * <targetname> is whatever name you want to give the trace
 * <pingcount> is the number of pings you're going to be doing to each node in the trace. This must match the -c parameter to mtr (see below).
 
-Modify the echo statement accordingly.
 
 The MTR execution part requires the following:
 

data/agent/mtrtrace-dns.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+ORIGIN_NAME=$1
+TARGET_NAME=$2
+PING_COUNT=$3
+TARGET_IP=$4
+LOGSTASH_IP=$5
+LOGSTASH_PORT=$6
+
+if [ -z "$1" ] ; then
+	echo "USAGE:"
+	echo "$0 <ORIGIN_NAME> <TARGET_NAME> <PING_COUNT> <TARGET_IP> <LOGSTASH_IP> <LOGSTASH_PORT>"
+	exit
+fi
+
+while true ; do echo -n '.'; (echo "s 0 $ORIGIN_NAME $TARGET_NAME 1";mtr --raw -c $PING_COUNT $TARGET_IP ) | awk '{printf $0";"}'  | nc $LOGSTASH_IP $LOGSTASH_PORT ; done
+

data/agent/mtrtrace.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+ORIGIN_NAME=$1
+TARGET_NAME=$2
+PING_COUNT=$3
+TARGET_IP=$4
+LOGSTASH_IP=$5
+LOGSTASH_PORT=$6
+
+if [ -z "$1" ] ; then
+	echo "USAGE:"
+	echo "$0 <ORIGIN_NAME> <TARGET_NAME> <PING_COUNT> <TARGET_IP> <LOGSTASH_IP> <LOGSTASH_PORT>"
+	exit
+fi
+
+while true ; do echo -n '.'; (echo "s 0 $ORIGIN_NAME $TARGET_NAME 1";mtr --raw --no-dns  -c $PING_COUNT $TARGET_IP ) | awk '{printf $0";"}'  | nc $LOGSTASH_IP $LOGSTASH_PORT ; done
+

data/lib/logstash/codecs/mtrraw.rb

@@ -4,6 +4,7 @@ require "logstash/codecs/line"
 require "logstash/namespace"
 require "securerandom"
 require "digest"
+require 'awesome_print'
 
 
 # This codec presumes you've somehow sent in the equivalent of this
@@ -57,7 +58,12 @@ class LogStash::Codecs::Mtrraw < LogStash::Codecs::Base
     if mtrrecs[0].type == 's'
     	target = mtrrecs.shift.data
 	pingcount = 0
-	if target =~ /(\w+) (\d+)/
+	if target =~ /(\w+) (\w+) (\d+)/
+		origin = $1
+		target = $2
+		pingcount = $3
+	elsif target =~ /(\w+) (\d+)/
+		origin = "ORIGIN"
 		target = $1
 		pingcount = $2
 	end
@@ -93,23 +99,26 @@ class LogStash::Codecs::Mtrraw < LogStash::Codecs::Base
 			"avgrtt" => avgrtt,
 			"tags" => ["wholepath"]
 	}
-    yield LogStash::Event.new(tracedata)
+    wholepathevent = LogStash::Event.new(tracedata)
+    yield wholepathevent
     # Construct a starting point for trace to target
     yield LogStash::Event.new({
 	"id" => id,
+	"origin" => origin,
 	"target" => target,
 	"tags" => ["hop"],
 	"seq" => -1,
 	"pathsig" => pathsig,
-	"A_node" => "TO:#{target}",
+	"A_node" => "#{origin}->#{target}",
 	"Z_node" => hops[0][:addr],
-	"dns" => "startingpoint",
+	"dns" => origin,
 	"avgrtt" => 0,
 	"avgloss" => 0
     })
     0.upto(path.size - 2) {
        |index|
        yield LogStash::Event.new({	"id" => id,
+					"origin" => origin,
 					"target" => target,
                                    	"tags" => ["hop"],
 					"pathsig" => pathsig,

data/logstash-codec-mtrraw.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name          = 'logstash-codec-mtrraw'
-  s.version       = '0.1.0'
+  s.version       = '0.2.0'
   s.licenses      = ['Apache License (2.0)']
   s.summary       = 'Converts optionally overloaded mtr --raw data to an event'
   s.description   = 'Turn mtr --raw events with optional overloading into logstash events.  see docs'
@@ -10,7 +10,7 @@ Gem::Specification.new do |s|
   s.require_paths = ['lib']
 
   # Files
-  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
+  s.files = Dir['agent/*','lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
    # Tests
   s.test_files = s.files.grep(%r{^(test|spec|features)/})
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-codec-mtrraw
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - svdasein
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-11-27 00:00:00.000000000 Z
+date: 2017-11-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core-plugin-api
@@ -64,6 +64,8 @@ files:
 - Gemfile
 - LICENSE
 - README.md
+- agent/mtrtrace-dns.sh
+- agent/mtrtrace.sh
 - lib/logstash/codecs/mtrraw.rb
 - logstash-codec-mtrraw.gemspec
 - spec/codecs/mtrraw_spec.rb