logstash-codec-netflow 3.2.0 → 3.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +6 -0
- data/lib/logstash/codecs/netflow.rb +12 -10
- data/logstash-codec-netflow.gemspec +1 -1
- data/spec/codecs/netflow_spec.rb +5 -5
- metadata +31 -33
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 8eed13d17d78bcdbbb2788a458fb2d6109e3dfce
|
|
4
|
+
data.tar.gz: 3886e83de50aded411f7d5ee26832f56998fbd8b
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 15b4bacc7bb1d6263cb9ec4f67ea360b5c0686503ace7442a75b8da99090865cf2e6753cf43a465132b5b42b010afede5607e67ae19f7a78e07c67fd62735d07
|
|
7
|
+
data.tar.gz: 7442867f8718b82330cb1a7c8592ea3c1367e14f1f12966a4db788a751d5a802638706a5c20ce7ccb8cd5e937cf65b210b90fae2c4dde0a5a089430608e17f83
|
data/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,9 @@
|
|
|
1
|
+
## 3.2.1
|
|
2
|
+
|
|
3
|
+
- Fix/Refactor IPFIX microsecond/nanosecond interpretation (NTP Timestamp based)
|
|
4
|
+
- Note a possible bug in Netscaler implementation where the fraction is proabably output as microseconds
|
|
5
|
+
- Correct rspec testing for new/correct implementation of microseconds, never noticed the insane values before, mea culpa
|
|
6
|
+
|
|
1
7
|
## 3.2.0
|
|
2
8
|
|
|
3
9
|
- Add Netflow v9/v10 template caching, configurable TTL
|
|
@@ -414,16 +414,18 @@ class LogStash::Codecs::Netflow < LogStash::Codecs::Base
|
|
|
414
414
|
when /^flow(?:Start|End)Seconds$/
|
|
415
415
|
event[@target][k.to_s] = LogStash::Timestamp.at(v.snapshot).to_iso8601
|
|
416
416
|
when /^flow(?:Start|End)(Milli|Micro|Nano)seconds$/
|
|
417
|
-
|
|
418
|
-
|
|
419
|
-
|
|
420
|
-
|
|
421
|
-
|
|
422
|
-
|
|
423
|
-
|
|
424
|
-
|
|
425
|
-
|
|
426
|
-
|
|
417
|
+
case $1
|
|
418
|
+
when 'Milli'
|
|
419
|
+
event[@target][k.to_s] = LogStash::Timestamp.at(v.snapshot.to_f / 1_000).to_iso8601
|
|
420
|
+
when 'Micro', 'Nano'
|
|
421
|
+
# For now we'll stick to assuming ntp timestamps,
|
|
422
|
+
# Netscaler implementation may be buggy though:
|
|
423
|
+
# https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11047
|
|
424
|
+
# This only affects the fraction though
|
|
425
|
+
ntp_seconds = (v.snapshot >> 32) & 0xFFFFFFFF
|
|
426
|
+
ntp_fraction = (v.snapshot & 0xFFFFFFFF).to_f / 2**32
|
|
427
|
+
event[@target][k.to_s] = LogStash::Timestamp.at(Time.utc(1900,1,1).to_i + ntp_seconds, ntp_fraction * 1000000).to_iso8601
|
|
428
|
+
end
|
|
427
429
|
else
|
|
428
430
|
event[@target][k.to_s] = v.snapshot
|
|
429
431
|
end
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
Gem::Specification.new do |s|
|
|
2
2
|
|
|
3
3
|
s.name = 'logstash-codec-netflow'
|
|
4
|
-
s.version = '3.2.
|
|
4
|
+
s.version = '3.2.1'
|
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
|
6
6
|
s.summary = "The netflow codec is for decoding Netflow v5/v9/v10 (IPFIX) flows."
|
|
7
7
|
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
data/spec/codecs/netflow_spec.rb
CHANGED
|
@@ -984,7 +984,7 @@ describe LogStash::Codecs::Netflow do
|
|
|
984
984
|
"netscalerHttpReqUserAgent": "Mozilla/5.0 (Commodore 64; kobo.com) Gecko/20100101 Firefox/75.0",
|
|
985
985
|
"destinationTransportPort": 443,
|
|
986
986
|
"netscalerHttpReqCookie": "beer=123456789abcdefghijklmnopqrstuvw; AnotherCookie=1234567890abcdefghijklmnopqr; Shameless.Plug=Thankyou.Rakuten.Kobo.Inc.For.Allowing.me.time.to.work.on.this.and.contribute.back.to.the.community; Padding=aaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbccccccccccccccddddddddddddddddddddddeeeeeeeeeeeeeeeeeeeeeffffffffffffffffffffffgggggggggggggggggggggggghhhhhhhhhhhhhhhhhiiiiiiiiiiiiiiiiiiiiiijjjjjjjjjjjjjjjjjjjjjjjjkkkkkkkkkkkkkkkkkklllllllllllllllmmmmmmmmmm; more=less; GJquote=There.is.no.spoon; GarrySays=Nice!!; LastPadding=aaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbcccccccccccccccccccdddddddddddeeeeeeee",
|
|
987
|
-
"flowEndMicroseconds": "
|
|
987
|
+
"flowEndMicroseconds": "2016-11-11T12:09:19.000Z",
|
|
988
988
|
"netscalerHttpReqUrl": "/aa/bb/ccccc/ddddddddddddddddddddddddd",
|
|
989
989
|
"sourceIPv4Address": "192.168.0.1",
|
|
990
990
|
"netscalerHttpReqMethod": "GET",
|
|
@@ -1003,7 +1003,7 @@ describe LogStash::Codecs::Netflow do
|
|
|
1003
1003
|
"netscalerHttpReqVia": "1.1 akamai.net(ghost) (AkamaiGHost)",
|
|
1004
1004
|
"netscalerConnectionId": 14460661,
|
|
1005
1005
|
"tcpControlBits": 24,
|
|
1006
|
-
"flowStartMicroseconds": "
|
|
1006
|
+
"flowStartMicroseconds": "2016-11-11T12:09:19.000Z",
|
|
1007
1007
|
"ingressInterface": 8,
|
|
1008
1008
|
"version": 10,
|
|
1009
1009
|
"packetDeltaCount": 2,
|
|
@@ -1031,7 +1031,7 @@ describe LogStash::Codecs::Netflow do
|
|
|
1031
1031
|
expect(decode[0].get("[netflow][version]")).to eq(10)
|
|
1032
1032
|
expect(decode[0].get("[netflow][sourceIPv4Address]")).to eq('192.168.0.1')
|
|
1033
1033
|
expect(decode[0].get("[netflow][destinationIPv4Address]")).to eq('10.0.0.1')
|
|
1034
|
-
expect(decode[0].get("[netflow][flowEndMicroseconds]")).to eq('
|
|
1034
|
+
expect(decode[0].get("[netflow][flowEndMicroseconds]")).to eq('2016-11-11T12:09:19.000Z')
|
|
1035
1035
|
expect(decode[0].get("[netflow][netscalerConnectionId]")).to eq(14460661)
|
|
1036
1036
|
expect(decode[1].get("[netflow][version]")).to eq(10)
|
|
1037
1037
|
expect(decode[1].get("[netflow][flowId]")).to eq(14460662)
|
|
@@ -1215,7 +1215,7 @@ describe LogStash::Codecs::Netflow, 'configured with template caching', :order =
|
|
|
1215
1215
|
it "should decode raw data based on cached templates" do
|
|
1216
1216
|
expect(decode.size).to eq(3)
|
|
1217
1217
|
expect(decode[0].get("[netflow][version]")).to eq(10)
|
|
1218
|
-
expect(decode[0].get("[netflow][flowEndMicroseconds]")).to eq('
|
|
1218
|
+
expect(decode[0].get("[netflow][flowEndMicroseconds]")).to eq('2016-11-11T12:09:19.000Z')
|
|
1219
1219
|
expect(decode[0].get("[netflow][netscalerConnectionId]")).to eq(14460661)
|
|
1220
1220
|
expect(decode[1].get("[netflow][version]")).to eq(10)
|
|
1221
1221
|
expect(decode[1].get("[netflow][observationPointId]")).to eq(167954698)
|
|
@@ -1256,7 +1256,7 @@ describe LogStash::Codecs::Netflow, 'configured with include_flowset_id for ipfi
|
|
|
1256
1256
|
it "should decode raw data" do
|
|
1257
1257
|
expect(decode.size).to eq(3)
|
|
1258
1258
|
expect(decode[0].get("[netflow][version]")).to eq(10)
|
|
1259
|
-
expect(decode[0].get("[netflow][flowEndMicroseconds]")).to eq('
|
|
1259
|
+
expect(decode[0].get("[netflow][flowEndMicroseconds]")).to eq('2016-11-11T12:09:19.000Z')
|
|
1260
1260
|
expect(decode[0].get("[netflow][netscalerConnectionId]")).to eq(14460661)
|
|
1261
1261
|
expect(decode[1].get("[netflow][version]")).to eq(10)
|
|
1262
1262
|
expect(decode[1].get("[netflow][observationPointId]")).to eq(167954698)
|
metadata
CHANGED
|
@@ -1,17 +1,16 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: logstash-codec-netflow
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 3.2.
|
|
4
|
+
version: 3.2.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Elastic
|
|
8
|
-
autorequire:
|
|
8
|
+
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2016-12-
|
|
11
|
+
date: 2016-12-21 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
|
-
name: logstash-core-plugin-api
|
|
15
14
|
requirement: !ruby/object:Gem::Requirement
|
|
16
15
|
requirements:
|
|
17
16
|
- - '>='
|
|
@@ -20,8 +19,9 @@ dependencies:
|
|
|
20
19
|
- - <=
|
|
21
20
|
- !ruby/object:Gem::Version
|
|
22
21
|
version: '2.99'
|
|
23
|
-
|
|
22
|
+
name: logstash-core-plugin-api
|
|
24
23
|
prerelease: false
|
|
24
|
+
type: :runtime
|
|
25
25
|
version_requirements: !ruby/object:Gem::Requirement
|
|
26
26
|
requirements:
|
|
27
27
|
- - '>='
|
|
@@ -31,47 +31,54 @@ dependencies:
|
|
|
31
31
|
- !ruby/object:Gem::Version
|
|
32
32
|
version: '2.99'
|
|
33
33
|
- !ruby/object:Gem::Dependency
|
|
34
|
-
name: bindata
|
|
35
34
|
requirement: !ruby/object:Gem::Requirement
|
|
36
35
|
requirements:
|
|
37
36
|
- - '>='
|
|
38
37
|
- !ruby/object:Gem::Version
|
|
39
38
|
version: 1.5.0
|
|
40
|
-
|
|
39
|
+
name: bindata
|
|
41
40
|
prerelease: false
|
|
41
|
+
type: :runtime
|
|
42
42
|
version_requirements: !ruby/object:Gem::Requirement
|
|
43
43
|
requirements:
|
|
44
44
|
- - '>='
|
|
45
45
|
- !ruby/object:Gem::Version
|
|
46
46
|
version: 1.5.0
|
|
47
47
|
- !ruby/object:Gem::Dependency
|
|
48
|
-
name: logstash-devutils
|
|
49
48
|
requirement: !ruby/object:Gem::Requirement
|
|
50
49
|
requirements:
|
|
51
50
|
- - '>='
|
|
52
51
|
- !ruby/object:Gem::Version
|
|
53
52
|
version: 1.0.0
|
|
54
|
-
|
|
53
|
+
name: logstash-devutils
|
|
55
54
|
prerelease: false
|
|
55
|
+
type: :development
|
|
56
56
|
version_requirements: !ruby/object:Gem::Requirement
|
|
57
57
|
requirements:
|
|
58
58
|
- - '>='
|
|
59
59
|
- !ruby/object:Gem::Version
|
|
60
60
|
version: 1.0.0
|
|
61
|
-
description: This gem is a Logstash plugin required to be installed on top of the
|
|
62
|
-
Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
|
|
63
|
-
gem is not a stand-alone program
|
|
61
|
+
description: This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program
|
|
64
62
|
email: info@elastic.co
|
|
65
63
|
executables: []
|
|
66
64
|
extensions: []
|
|
67
65
|
extra_rdoc_files: []
|
|
68
66
|
files:
|
|
67
|
+
- CHANGELOG.md
|
|
68
|
+
- CONTRIBUTORS
|
|
69
|
+
- Gemfile
|
|
70
|
+
- LICENSE
|
|
71
|
+
- NOTICE.TXT
|
|
72
|
+
- README.md
|
|
73
|
+
- lib/logstash/codecs/netflow.rb
|
|
69
74
|
- lib/logstash/codecs/netflow/iana2yaml.rb
|
|
70
|
-
- lib/logstash/codecs/netflow/netflow.yaml
|
|
71
75
|
- lib/logstash/codecs/netflow/ipfix.yaml
|
|
76
|
+
- lib/logstash/codecs/netflow/netflow.yaml
|
|
72
77
|
- lib/logstash/codecs/netflow/util.rb
|
|
73
|
-
-
|
|
78
|
+
- logstash-codec-netflow.gemspec
|
|
74
79
|
- spec/codecs/ipfix.dat
|
|
80
|
+
- spec/codecs/ipfix_test_netscaler_data.dat
|
|
81
|
+
- spec/codecs/ipfix_test_netscaler_tpl.dat
|
|
75
82
|
- spec/codecs/ipfix_test_openbsd_pflow_data.dat
|
|
76
83
|
- spec/codecs/ipfix_test_openbsd_pflow_tpl.dat
|
|
77
84
|
- spec/codecs/netflow5.dat
|
|
@@ -90,27 +97,18 @@ files:
|
|
|
90
97
|
- spec/codecs/netflow9_test_nprobe_data.dat
|
|
91
98
|
- spec/codecs/netflow9_test_nprobe_tpl.dat
|
|
92
99
|
- spec/codecs/netflow9_test_softflowd_tpl_data.dat
|
|
93
|
-
- spec/codecs/netflow9_test_valid01.dat
|
|
94
|
-
- spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
|
|
95
100
|
- spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
|
|
96
101
|
- spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
|
|
97
|
-
- spec/codecs/
|
|
98
|
-
- spec/codecs/
|
|
102
|
+
- spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
|
|
103
|
+
- spec/codecs/netflow9_test_valid01.dat
|
|
99
104
|
- spec/codecs/netflow_spec.rb
|
|
100
|
-
- logstash-codec-netflow.gemspec
|
|
101
|
-
- README.md
|
|
102
|
-
- CHANGELOG.md
|
|
103
|
-
- CONTRIBUTORS
|
|
104
|
-
- Gemfile
|
|
105
|
-
- LICENSE
|
|
106
|
-
- NOTICE.TXT
|
|
107
105
|
homepage: http://www.elastic.co/guide/en/logstash/current/index.html
|
|
108
106
|
licenses:
|
|
109
107
|
- Apache License (2.0)
|
|
110
108
|
metadata:
|
|
111
109
|
logstash_plugin: 'true'
|
|
112
110
|
logstash_group: codec
|
|
113
|
-
post_install_message:
|
|
111
|
+
post_install_message:
|
|
114
112
|
rdoc_options: []
|
|
115
113
|
require_paths:
|
|
116
114
|
- lib
|
|
@@ -125,13 +123,15 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
125
123
|
- !ruby/object:Gem::Version
|
|
126
124
|
version: '0'
|
|
127
125
|
requirements: []
|
|
128
|
-
rubyforge_project:
|
|
129
|
-
rubygems_version: 2.
|
|
130
|
-
signing_key:
|
|
126
|
+
rubyforge_project:
|
|
127
|
+
rubygems_version: 2.4.8
|
|
128
|
+
signing_key:
|
|
131
129
|
specification_version: 4
|
|
132
130
|
summary: The netflow codec is for decoding Netflow v5/v9/v10 (IPFIX) flows.
|
|
133
131
|
test_files:
|
|
134
132
|
- spec/codecs/ipfix.dat
|
|
133
|
+
- spec/codecs/ipfix_test_netscaler_data.dat
|
|
134
|
+
- spec/codecs/ipfix_test_netscaler_tpl.dat
|
|
135
135
|
- spec/codecs/ipfix_test_openbsd_pflow_data.dat
|
|
136
136
|
- spec/codecs/ipfix_test_openbsd_pflow_tpl.dat
|
|
137
137
|
- spec/codecs/netflow5.dat
|
|
@@ -150,10 +150,8 @@ test_files:
|
|
|
150
150
|
- spec/codecs/netflow9_test_nprobe_data.dat
|
|
151
151
|
- spec/codecs/netflow9_test_nprobe_tpl.dat
|
|
152
152
|
- spec/codecs/netflow9_test_softflowd_tpl_data.dat
|
|
153
|
-
- spec/codecs/netflow9_test_valid01.dat
|
|
154
|
-
- spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
|
|
155
153
|
- spec/codecs/netflow9_test_ubnt_edgerouter_data1024.dat
|
|
156
154
|
- spec/codecs/netflow9_test_ubnt_edgerouter_data1025.dat
|
|
157
|
-
- spec/codecs/
|
|
158
|
-
- spec/codecs/
|
|
155
|
+
- spec/codecs/netflow9_test_ubnt_edgerouter_tpl.dat
|
|
156
|
+
- spec/codecs/netflow9_test_valid01.dat
|
|
159
157
|
- spec/codecs/netflow_spec.rb
|