logstash-codec-rfc6587 0.1.3 → 0.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/logstash/codecs/rfc6587.rb +19 -12
- data/logstash-codec-rfc6587.gemspec +1 -1
- data/spec/codecs/rfc6587_spec.rb +109 -93
- metadata +7 -7
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: d4b77071d659535df03e355c6608120d7d198b08eaccd52da29e5bc320933fb3
|
|
4
|
+
data.tar.gz: 7d00398f882083289ea13f6c75bdbd728d2b3a11ad6499e3c6b230c26082ca7a
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 73a1b782ef74480634c426b4b900a418672f7afe10a4b252588d9a0d3d79496f7b5396cf32f5411f653b3416ab13db9b8138e89304967f0f3b1664136c054166
|
|
7
|
+
data.tar.gz: c4a2988537b9aebc49f961dbb186389310acc507da1d69057bbe8b27bac3c9bd15fd3c14bc2c50117345466d0be82c723c3493b94224476c13470fddc0f3591a
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
# encoding: utf-8
|
|
2
|
+
|
|
2
3
|
require "logstash/codecs/base"
|
|
3
4
|
require "logstash/util/charset"
|
|
4
5
|
|
|
@@ -11,14 +12,13 @@ require 'logstash/plugin_mixins/event_support/event_factory_adapter'
|
|
|
11
12
|
#
|
|
12
13
|
# Encoding behavior: TBD
|
|
13
14
|
class LogStash::Codecs::Rfc6587 < LogStash::Codecs::Base
|
|
14
|
-
|
|
15
15
|
include LogStash::PluginMixins::ECSCompatibilitySupport(:disabled, :v1, :v8 => :v1)
|
|
16
16
|
include LogStash::PluginMixins::EventSupport::EventFactoryAdapter
|
|
17
17
|
|
|
18
18
|
config_name "rfc6587"
|
|
19
19
|
|
|
20
20
|
## Set the desired text format for encoding.
|
|
21
|
-
#config :format, :validate => :string
|
|
21
|
+
# config :format, :validate => :string
|
|
22
22
|
|
|
23
23
|
# The character encoding used in this input. Examples include `UTF-8`
|
|
24
24
|
# and `cp1252`
|
|
@@ -35,6 +35,8 @@ class LogStash::Codecs::Rfc6587 < LogStash::Codecs::Base
|
|
|
35
35
|
def initialize(*params)
|
|
36
36
|
super
|
|
37
37
|
|
|
38
|
+
raise "Delimitter must be 1 character long, but got '#{@delimiter}'" if @delimiter.length != 1
|
|
39
|
+
|
|
38
40
|
@original_field = ecs_select[disabled: nil, v1: '[event][original]']
|
|
39
41
|
end
|
|
40
42
|
|
|
@@ -48,13 +50,15 @@ class LogStash::Codecs::Rfc6587 < LogStash::Codecs::Base
|
|
|
48
50
|
|
|
49
51
|
def read(data)
|
|
50
52
|
header = ""
|
|
51
|
-
while c = data.
|
|
52
|
-
next if ["\0", "\x00"].include?(c)
|
|
53
|
+
while (c = data.getc)
|
|
54
|
+
next if ["\0", "\x00"].include?(c) # ignore null characters
|
|
53
55
|
raise "Unknown header character '#{c}'" if not [@delimiter, nil, c.to_i.to_s].include?(c)
|
|
56
|
+
|
|
54
57
|
header += c if c
|
|
55
58
|
break if c == @delimiter or data.eof or c == nil
|
|
56
59
|
end
|
|
57
60
|
raise "Unknown header '#{header}'" if header != "" and header.to_i == 0
|
|
61
|
+
|
|
58
62
|
if data.eof
|
|
59
63
|
@leftover = header
|
|
60
64
|
return
|
|
@@ -62,7 +66,11 @@ class LogStash::Codecs::Rfc6587 < LogStash::Codecs::Base
|
|
|
62
66
|
|
|
63
67
|
to_read = header.to_i
|
|
64
68
|
line = ""
|
|
65
|
-
to_read.times
|
|
69
|
+
to_read.times do
|
|
70
|
+
break if (c = data.getc) == nil
|
|
71
|
+
|
|
72
|
+
line += c
|
|
73
|
+
end
|
|
66
74
|
|
|
67
75
|
if not line
|
|
68
76
|
@leftover = header
|
|
@@ -79,22 +87,22 @@ class LogStash::Codecs::Rfc6587 < LogStash::Codecs::Base
|
|
|
79
87
|
|
|
80
88
|
def decode(data)
|
|
81
89
|
data = StringIO.new @leftover + data
|
|
82
|
-
while line = read(data)
|
|
90
|
+
while (line = read(data))
|
|
83
91
|
yield new_event_from_line(line)
|
|
84
92
|
end
|
|
85
93
|
end
|
|
86
94
|
|
|
87
95
|
def flush(&block)
|
|
88
|
-
#remainder = @buffer.flush
|
|
89
|
-
#if !remainder.empty?
|
|
96
|
+
# remainder = @buffer.flush
|
|
97
|
+
# if !remainder.empty?
|
|
90
98
|
# block.call new_event_from_line(remainder)
|
|
91
|
-
#end
|
|
99
|
+
# end
|
|
92
100
|
end
|
|
93
101
|
|
|
94
102
|
def encode(event)
|
|
95
103
|
raise "Not implemented"
|
|
96
|
-
#encoded = @format ? event.sprintf(@format) : event.to_s
|
|
97
|
-
|
|
104
|
+
# encoded = @format ? event.sprintf(@format) : event.to_s
|
|
105
|
+
# @on_event.call(event, encoded + @delimiter)
|
|
98
106
|
end
|
|
99
107
|
|
|
100
108
|
private
|
|
@@ -105,5 +113,4 @@ class LogStash::Codecs::Rfc6587 < LogStash::Codecs::Base
|
|
|
105
113
|
event.set @original_field, message.dup.freeze if @original_field
|
|
106
114
|
event
|
|
107
115
|
end
|
|
108
|
-
|
|
109
116
|
end
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
Gem::Specification.new do |s|
|
|
2
2
|
|
|
3
3
|
s.name = 'logstash-codec-rfc6587'
|
|
4
|
-
s.version = '0.1.
|
|
4
|
+
s.version = '0.1.5'
|
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
|
6
6
|
s.summary = "Reads lines as described in rfc6587"
|
|
7
7
|
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
data/spec/codecs/rfc6587_spec.rb
CHANGED
|
@@ -7,12 +7,11 @@ require "logstash/event"
|
|
|
7
7
|
require 'logstash/plugin_mixins/ecs_compatibility_support/spec_helper'
|
|
8
8
|
|
|
9
9
|
describe LogStash::Codecs::Rfc6587, :ecs_compatibility_support do
|
|
10
|
-
|
|
11
10
|
subject do
|
|
12
11
|
next LogStash::Codecs::Rfc6587.new
|
|
13
12
|
end
|
|
14
13
|
|
|
15
|
-
#context "#encode" do
|
|
14
|
+
# context "#encode" do
|
|
16
15
|
# let (:event) {LogStash::Event.new({"message" => "hello world", "host" => "test"})}
|
|
17
16
|
|
|
18
17
|
# it "should return a default date formatted line" do
|
|
@@ -46,100 +45,65 @@ describe LogStash::Codecs::Rfc6587, :ecs_compatibility_support do
|
|
|
46
45
|
# subject.encode(event)
|
|
47
46
|
# end
|
|
48
47
|
# end
|
|
49
|
-
#end
|
|
48
|
+
# end # context #encode
|
|
50
49
|
|
|
51
50
|
context "#decode" do
|
|
52
|
-
|
|
53
|
-
it "should return an event from an ascii string" do
|
|
54
|
-
decoded = false
|
|
55
|
-
subject.decode("11 hello world") do |e|
|
|
56
|
-
decoded = true
|
|
57
|
-
insist { e.is_a?(LogStash::Event) }
|
|
58
|
-
insist { e.get("message") } == "hello world"
|
|
59
|
-
end
|
|
60
|
-
insist { decoded } == true
|
|
61
|
-
end
|
|
62
|
-
|
|
63
|
-
it "should return nothing if input data is empty" do
|
|
64
|
-
decoded = false
|
|
65
|
-
subject.decode("") do |e|
|
|
66
|
-
decoded = true
|
|
67
|
-
end
|
|
68
|
-
insist { decoded } == false
|
|
69
|
-
end
|
|
70
|
-
|
|
71
|
-
it "should return nothing if input data is only '\\0' or '\\x00'" do
|
|
72
|
-
decoded = false
|
|
73
|
-
subject.decode("\0\x00") do |e|
|
|
74
|
-
decoded = true
|
|
75
|
-
end
|
|
76
|
-
insist { decoded } == false
|
|
77
|
-
end
|
|
78
|
-
|
|
79
|
-
it "should return an event from an ascii string prefixed with \\0" do
|
|
80
|
-
decoded = false
|
|
81
|
-
subject.decode("\x004 test") do |e|
|
|
82
|
-
decoded = true
|
|
83
|
-
insist { e.is_a?(LogStash::Event) }
|
|
84
|
-
insist { e.get("message") } == "test"
|
|
85
|
-
end
|
|
86
|
-
insist { decoded } == true
|
|
87
|
-
end
|
|
88
|
-
|
|
89
|
-
it "should contain correct results when input contains newline" do
|
|
90
|
-
result = []
|
|
91
|
-
subject.decode("5 line17 line2\n!5 line3") { |e| result << e }
|
|
92
|
-
subject.flush { |e| result << e }
|
|
93
|
-
expect(result.size).to eq(3)
|
|
94
|
-
expect(result[0].get("message")).to eq("line1")
|
|
95
|
-
expect(result[1].get("message")).to eq("line2\n!")
|
|
96
|
-
expect(result[2].get("message")).to eq("line3")
|
|
97
|
-
end
|
|
98
|
-
|
|
99
51
|
ecs_compatibility_matrix(:disabled, :v1, :v8 => :v1) do |ecs_select|
|
|
100
|
-
|
|
101
52
|
before(:each) do
|
|
102
53
|
allow_any_instance_of(described_class).to receive(:ecs_compatibility).and_return(ecs_compatibility)
|
|
103
54
|
end
|
|
104
55
|
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
expect( e.get("message") ).to eql message
|
|
112
|
-
expect( e.get("message").encoding ).to eql Encoding.find('UTF-8')
|
|
113
|
-
expect( e.get("message").valid_encoding? ).to be true
|
|
56
|
+
it "should return an event from an ascii string" do
|
|
57
|
+
decoded = false
|
|
58
|
+
subject.decode("11 hello world") do |e|
|
|
59
|
+
decoded = true
|
|
60
|
+
insist { e.is_a?(LogStash::Event) }
|
|
61
|
+
insist { e.get("message") } == "hello world"
|
|
114
62
|
end
|
|
63
|
+
insist { decoded } == true
|
|
115
64
|
end
|
|
116
65
|
|
|
117
|
-
it "
|
|
118
|
-
|
|
119
|
-
|
|
66
|
+
it "should return nothing if input data is empty" do
|
|
67
|
+
decoded = false
|
|
68
|
+
subject.decode("") do
|
|
69
|
+
decoded = true
|
|
120
70
|
end
|
|
121
|
-
|
|
71
|
+
insist { decoded } == false
|
|
72
|
+
end
|
|
122
73
|
|
|
123
|
-
|
|
74
|
+
it "should return nothing if input data is only '\\0' or '\\x00'" do
|
|
75
|
+
decoded = false
|
|
76
|
+
subject.decode("\0\x00") do
|
|
77
|
+
decoded = true
|
|
78
|
+
end
|
|
79
|
+
insist { decoded } == false
|
|
80
|
+
end
|
|
124
81
|
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
82
|
+
it "should return an event from an ascii string prefixed with \\0" do
|
|
83
|
+
decoded = false
|
|
84
|
+
subject.decode("\x004 test") do |e|
|
|
85
|
+
decoded = true
|
|
86
|
+
insist { e.is_a?(LogStash::Event) }
|
|
87
|
+
insist { e.get("message") } == "test"
|
|
88
|
+
end
|
|
89
|
+
insist { decoded } == true
|
|
128
90
|
end
|
|
129
91
|
|
|
130
|
-
it "should
|
|
131
|
-
line = "4 item4 item"
|
|
132
|
-
raw = "12|#{line}"
|
|
92
|
+
it "should contain correct results when input contains newline" do
|
|
133
93
|
result = []
|
|
134
|
-
subject.decode(
|
|
94
|
+
subject.decode("5 line17 line2\n!5 line3") { |e| result << e }
|
|
135
95
|
subject.flush { |e| result << e }
|
|
136
|
-
expect(result.size).to eq(
|
|
137
|
-
expect(result[0].get("message")).to eq(
|
|
96
|
+
expect(result.size).to eq(3)
|
|
97
|
+
expect(result[0].get("message")).to eq("line1")
|
|
98
|
+
expect(result[1].get("message")).to eq("line2\n!")
|
|
99
|
+
expect(result[2].get("message")).to eq("line3")
|
|
138
100
|
end
|
|
139
101
|
|
|
140
|
-
it "should
|
|
102
|
+
it "should parse partial batches" do
|
|
141
103
|
result = []
|
|
142
|
-
subject.decode("5
|
|
104
|
+
subject.decode("5 line15") { |e| result << e }
|
|
105
|
+
subject.decode(" line25 ") { |e| result << e }
|
|
106
|
+
subject.decode("line3") { |e| result << e }
|
|
143
107
|
subject.flush { |e| result << e }
|
|
144
108
|
expect(result.size).to eq(3)
|
|
145
109
|
expect(result[0].get("message")).to eq("line1")
|
|
@@ -147,21 +111,73 @@ describe LogStash::Codecs::Rfc6587, :ecs_compatibility_support do
|
|
|
147
111
|
expect(result[2].get("message")).to eq("line3")
|
|
148
112
|
end
|
|
149
113
|
|
|
150
|
-
|
|
151
|
-
|
|
114
|
+
it "should return an event from a valid utf-8 string" do
|
|
115
|
+
subject.decode("7 München") do |e|
|
|
116
|
+
expect(e).to be_a LogStash::Event
|
|
117
|
+
expect(e.get("message")).to eql "München"
|
|
118
|
+
expect(e.get("message").encoding).to eql Encoding.find('UTF-8')
|
|
119
|
+
expect(e.get("message").valid_encoding?).to be true
|
|
120
|
+
end
|
|
121
|
+
end
|
|
152
122
|
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
123
|
+
it "sets event.original in ECS mode" do
|
|
124
|
+
subject.decode("7 München") do |event|
|
|
125
|
+
expect(event.get("[event][original]")).to eql "München"
|
|
126
|
+
end
|
|
127
|
+
end if ecs_select.active_mode != :disabled
|
|
128
|
+
|
|
129
|
+
context "when using custom :delimiter" do
|
|
130
|
+
subject do
|
|
131
|
+
next LogStash::Codecs::Rfc6587.new("delimiter" => "|")
|
|
132
|
+
end
|
|
133
|
+
|
|
134
|
+
it "should fail if delimitter has an invalid length" do
|
|
135
|
+
expect {
|
|
136
|
+
LogStash::Codecs::Rfc6587.new("delimiter" => "")
|
|
137
|
+
}.to raise_error(RuntimeError,
|
|
138
|
+
"Delimitter must be 1 character long, but got ''")
|
|
139
|
+
expect {
|
|
140
|
+
LogStash::Codecs::Rfc6587.new("delimiter" => "xx")
|
|
141
|
+
}.to raise_error(RuntimeError,
|
|
142
|
+
"Delimitter must be 1 character long, but got 'xx'")
|
|
143
|
+
end
|
|
144
|
+
|
|
145
|
+
it "should not break lines by '<number><space><line>'" do
|
|
146
|
+
line = "4 item4 item"
|
|
147
|
+
raw = "12|#{line}"
|
|
148
|
+
result = []
|
|
149
|
+
subject.decode(raw) { |e| result << e }
|
|
150
|
+
subject.flush { |e| result << e }
|
|
151
|
+
expect(result.size).to eq(1)
|
|
152
|
+
expect(result[0].get("message")).to eq(line)
|
|
153
|
+
end
|
|
154
|
+
|
|
155
|
+
it "should break lines by that delimiter" do
|
|
156
|
+
result = []
|
|
157
|
+
subject.decode("5|line15|line25|line3") { |e| result << e }
|
|
158
|
+
subject.flush { |e| result << e }
|
|
159
|
+
expect(result.size).to eq(3)
|
|
160
|
+
expect(result[0].get("message")).to eq("line1")
|
|
161
|
+
expect(result[1].get("message")).to eq("line2")
|
|
162
|
+
expect(result[2].get("message")).to eq("line3")
|
|
163
|
+
end
|
|
164
|
+
|
|
165
|
+
context "and it being unicode" do
|
|
166
|
+
subject do
|
|
167
|
+
next LogStash::Codecs::Rfc6587.new("delimiter" => "÷")
|
|
168
|
+
end
|
|
169
|
+
|
|
170
|
+
it "should produce correct events" do
|
|
171
|
+
line = "4÷item4÷item"
|
|
172
|
+
result = []
|
|
173
|
+
subject.decode(line) { |e| result << e }
|
|
174
|
+
subject.flush { |e| result << e }
|
|
175
|
+
expect(result.size).to eq(2)
|
|
176
|
+
expect(result[0].get("message")).to eq('item')
|
|
177
|
+
expect(result[1].get("message")).to eq('item')
|
|
178
|
+
end
|
|
179
|
+
end # context unicode delimiter
|
|
180
|
+
end # context custom delimiter
|
|
181
|
+
end # ecs compat
|
|
182
|
+
end # context #decode
|
|
183
|
+
end # describe
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: logstash-codec-rfc6587
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.1.
|
|
4
|
+
version: 0.1.5
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Elastic
|
|
@@ -9,7 +9,7 @@ authors:
|
|
|
9
9
|
autorequire:
|
|
10
10
|
bindir: bin
|
|
11
11
|
cert_chain: []
|
|
12
|
-
date: 2024-10-
|
|
12
|
+
date: 2024-10-17 00:00:00.000000000 Z
|
|
13
13
|
dependencies:
|
|
14
14
|
- !ruby/object:Gem::Dependency
|
|
15
15
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -21,8 +21,8 @@ dependencies:
|
|
|
21
21
|
- !ruby/object:Gem::Version
|
|
22
22
|
version: '2.99'
|
|
23
23
|
name: logstash-core-plugin-api
|
|
24
|
-
prerelease: false
|
|
25
24
|
type: :runtime
|
|
25
|
+
prerelease: false
|
|
26
26
|
version_requirements: !ruby/object:Gem::Requirement
|
|
27
27
|
requirements:
|
|
28
28
|
- - ">="
|
|
@@ -38,8 +38,8 @@ dependencies:
|
|
|
38
38
|
- !ruby/object:Gem::Version
|
|
39
39
|
version: '1.0'
|
|
40
40
|
name: logstash-mixin-event_support
|
|
41
|
-
prerelease: false
|
|
42
41
|
type: :runtime
|
|
42
|
+
prerelease: false
|
|
43
43
|
version_requirements: !ruby/object:Gem::Requirement
|
|
44
44
|
requirements:
|
|
45
45
|
- - "~>"
|
|
@@ -52,8 +52,8 @@ dependencies:
|
|
|
52
52
|
- !ruby/object:Gem::Version
|
|
53
53
|
version: '1.3'
|
|
54
54
|
name: logstash-mixin-ecs_compatibility_support
|
|
55
|
-
prerelease: false
|
|
56
55
|
type: :runtime
|
|
56
|
+
prerelease: false
|
|
57
57
|
version_requirements: !ruby/object:Gem::Requirement
|
|
58
58
|
requirements:
|
|
59
59
|
- - "~>"
|
|
@@ -66,8 +66,8 @@ dependencies:
|
|
|
66
66
|
- !ruby/object:Gem::Version
|
|
67
67
|
version: '0'
|
|
68
68
|
name: logstash-devutils
|
|
69
|
-
prerelease: false
|
|
70
69
|
type: :development
|
|
70
|
+
prerelease: false
|
|
71
71
|
version_requirements: !ruby/object:Gem::Requirement
|
|
72
72
|
requirements:
|
|
73
73
|
- - ">="
|
|
@@ -80,8 +80,8 @@ dependencies:
|
|
|
80
80
|
- !ruby/object:Gem::Version
|
|
81
81
|
version: '0'
|
|
82
82
|
name: insist
|
|
83
|
-
prerelease: false
|
|
84
83
|
type: :development
|
|
84
|
+
prerelease: false
|
|
85
85
|
version_requirements: !ruby/object:Gem::Requirement
|
|
86
86
|
requirements:
|
|
87
87
|
- - ">="
|