logstash-codec-sflow 0.3.0 → 0.4.0

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: cd2eaaabdcac4aa04d07417a080f816d3ca10312
4
- data.tar.gz: ed4a423a37954b8d3828da46f46b721c3970f208
3
+ metadata.gz: 7eed203acbba949c5f6db0d5d1d73b0b0f058236
4
+ data.tar.gz: 15d9572d80d50e9c130b9aa6f53e581676e95930
5
5
  SHA512:
6
- metadata.gz: a4a26572a0c3cd25e870f3858be947ef83489932b20f097a5d8e7032954db83c3980e169acb1f3a96d9b562e1398fb6e02e4dfa2eb1650b9325ed07eaa164c56
7
- data.tar.gz: 9ecbdf91625700f3a3396ff712b9a89bd2d5ba26858660d36be61a570ee479b9da8067bc58d5f1b4191e6301b674fc5358773dfd4d2aa243c13c66abc83f26f1
6
+ metadata.gz: b1f27e4c93a87f4c69f42db0ec71556bb683a307283c8963df58caad3d8d35c2b47a447df3f1c60b74460423c70d43522bdf540c12126760f24e2e7357170236
7
+ data.tar.gz: 398fdfe771b31be2f222f2b2af7ae328050a27173a9a0da60e22e52db36cc5dec0f31207bd68170238aaa05b289cda2740ffa0f7d373cb2ff8c1a97e749bd178
data/README.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # Logstash Codec SFlow Plugin
2
2
  ## Description
3
- Logstash codec plugin to decrypt sflow
3
+ Logstash codec plugin to decode sflow codec
4
4
 
5
5
  [![Build
6
6
  Status](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Codecs/job/logstash-plugin-codec-example-unit/badge/icon)](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Codecs/job/logstash-plugin-codec-example-unit/)
@@ -65,7 +65,7 @@ bundle exec rspec
65
65
 
66
66
  - Edit Logstash `tools/Gemfile` and add the local plugin path, for example:
67
67
  ```ruby
68
- gem "logstash-codec-sflow", :path => "/your/local/logstash-filter-awesome"
68
+ gem "logstash-codec-sflow", :path => "/your/local/logstash-codec-sflow"
69
69
  ```
70
70
  - Update Logstash dependencies
71
71
  ```sh
@@ -73,7 +73,7 @@ rake vendor:gems
73
73
  ```
74
74
  - Run Logstash with your plugin
75
75
  ```sh
76
- bin/logstash -e 'filter {awesome {}}'
76
+ bin/logstash -e 'input { udp { port => 6343 codec => sflow }}'
77
77
  ```
78
78
  At this point any modifications to the plugin code will be applied to this local Logstash setup. After modifying the plugin, simply rerun Logstash.
79
79
 
@@ -81,11 +81,11 @@ At this point any modifications to the plugin code will be applied to this local
81
81
 
82
82
  - Build your plugin gem
83
83
  ```sh
84
- gem build logstash-filter-awesome.gemspec
84
+ gem build logstash-codec-sflow.gemspec
85
85
  ```
86
86
  - Install the plugin from the Logstash home
87
87
  ```sh
88
- bin/plugin install /your/local/plugin/logstash-filter-awesome.gem
88
+ bin/plugin install /your/local/plugin/logstash-codec-sflow.gem
89
89
  ```
90
90
  - Start Logstash and proceed to test the plugin
91
91
 
@@ -14,11 +14,34 @@ class LogStash::Codecs::Sflow < LogStash::Codecs::Base
14
14
  super(params)
15
15
  @threadsafe = false
16
16
  # noinspection RubyResolve
17
- @removed_field = %w(record_length record_count record_entreprise record_format sample_entreprise sample_format sample_length sample_count sample_header layer3 layer4 layer4_data header udata) | @optional_removed_field
17
+ @removed_field = %w(records record_data record_length record_count record_entreprise record_format samples sample_data sample_entreprise sample_format sample_length sample_count sample_header layer3 layer4 layer4_data header udata) | @optional_removed_field
18
18
  end
19
19
 
20
20
  # def initialize
21
21
 
22
+ def assign_key_value(event, bindata_kv)
23
+ bindata_kv.each_pair do |k, v|
24
+ unless @removed_field.include? k.to_s
25
+ event["#{k}"] = v
26
+ end
27
+ end
28
+ end
29
+
30
+ def common_sflow(event, decoded, sample, record)
31
+ # Ensure that some data exist for the record
32
+ if record['record_data'].to_s.eql? ''
33
+ @logger.warn("Unknown record entreprise #{record['record_entreprise'].to_s}, format #{record['record_format'].to_s}")
34
+ next
35
+ end
36
+
37
+ assign_key_value(event, decoded)
38
+ assign_key_value(event, sample)
39
+ assign_key_value(event, sample['sample_data'])
40
+ assign_key_value(event, record)
41
+ assign_key_value(event, record['record_data'])
42
+
43
+ end
44
+
22
45
  public
23
46
  def register
24
47
  require 'logstash/codecs/sflow/datagram'
@@ -47,61 +70,14 @@ class LogStash::Codecs::Sflow < LogStash::Codecs::Base
47
70
  LogStash::Event::TIMESTAMP => LogStash::Timestamp.now
48
71
  }
49
72
  sample['sample_data']['records'].each do |record|
50
- # Ensure that some data exist for the record
51
- if record['record_data'].to_s.eql? ''
52
- @logger.warn("Unknown record entreprise #{record['record_entreprise'].to_s}, format #{record['record_format'].to_s}")
53
- next
54
- end
55
-
56
- decoded.each_pair do |k, v|
57
- unless k.to_s.eql? 'samples' or @removed_field.include? k.to_s
58
- event["#{k}"] = v
59
- end
60
- end
61
-
62
- sample.each_pair do |k, v|
63
- unless k.to_s.eql? 'sample_data' or @removed_field.include? k.to_s
64
- event["#{k}"] = v
65
- end
66
- end
67
-
68
- sample['sample_data'].each_pair do |k, v|
69
- unless k.to_s.eql? 'records' or @removed_field.include? k.to_s
70
- event["#{k}"] = v
71
- end
72
- end
73
-
74
- record.each_pair do |k, v|
75
- unless k.to_s.eql? 'record_data' or @removed_field.include? k.to_s
76
- event["#{k}"] = v
77
- end
78
- end
79
-
80
- record['record_data'].each_pair do |k, v|
81
- unless k.to_s.eql? 'record_data' or @removed_field.include? k.to_s
82
- event["#{k}"] = v
83
- end
84
- end
73
+ common_sflow(event, decoded, sample, record)
85
74
 
86
75
  unless record['record_data']['sample_header'].to_s.eql? ''
87
- record['record_data']['sample_header'].each_pair do |k, v|
88
- unless k.to_s.eql? 'record_data' or @removed_field.include? k.to_s
89
- event["#{k}"] = v
90
- end
91
- end
76
+ assign_key_value(event, record['record_data']['sample_header'])
92
77
 
93
78
  if record['record_data']['sample_header'].has_key?('layer3')
94
- record['record_data']['sample_header']['layer3']['header'].each_pair do |k, v|
95
- unless k.to_s.eql? 'record_data' or @removed_field.include? k.to_s
96
- event["#{k}"] = v
97
- end
98
- end
99
-
100
- record['record_data']['sample_header']['layer3']['header']['layer4'].each_pair do |k, v|
101
- unless k.to_s.eql? 'record_data' or @removed_field.include? k.to_s
102
- event["#{k}"] = v
103
- end
104
- end
79
+ assign_key_value(event, record['record_data']['sample_header']['layer3']['header'])
80
+ assign_key_value(event, record['record_data']['sample_header']['layer3']['header']['layer4'])
105
81
  end
106
82
  end
107
83
 
@@ -111,44 +87,12 @@ class LogStash::Codecs::Sflow < LogStash::Codecs::Base
111
87
  #treat counter flow
112
88
  elsif sample['sample_entreprise'] == 0 && sample['sample_format'] == 2
113
89
  sample['sample_data']['records'].each do |record|
114
- # Ensure that some data exist for the record
115
- if record['record_data'].to_s.eql? ''
116
- @logger.warn("Unknown record entreprise #{record['record_entreprise'].to_s}, format #{record['record_format'].to_s}")
117
- next
118
- end
119
-
120
90
  # Create the logstash event
121
91
  event = {
122
92
  LogStash::Event::TIMESTAMP => LogStash::Timestamp.now
123
93
  }
124
94
 
125
- decoded.each_pair do |k, v|
126
- unless k.to_s.eql? 'samples' or @removed_field.include? k.to_s
127
- event["#{k}"] = v
128
- end
129
- end
130
-
131
- sample.each_pair do |k, v|
132
- unless k.to_s.eql? 'sample_data' or @removed_field.include? k.to_s
133
- event["#{k}"] = v
134
- end
135
- end
136
-
137
- sample['sample_data'].each_pair do |k, v|
138
- unless k.to_s.eql? 'records' or @removed_field.include? k.to_s
139
- event["#{k}"] = v
140
- end
141
- end
142
-
143
- record.each_pair do |k, v|
144
- unless k.to_s.eql? 'record_data' or @removed_field.include? k.to_s
145
- event["#{k}"] = v
146
- end
147
- end
148
-
149
- record['record_data'].each_pair do |k, v|
150
- event["#{k}"] = v
151
- end
95
+ common_sflow(event, decoded, sample, record)
152
96
 
153
97
  events.push(event)
154
98
  end
@@ -1,7 +1,7 @@
1
1
  Gem::Specification.new do |s|
2
2
 
3
3
  s.name = 'logstash-codec-sflow'
4
- s.version = '0.3.0'
4
+ s.version = '0.4.0'
5
5
  s.licenses = ['Apache License (2.0)']
6
6
  s.summary = "The sflow codec is for decoding SFlow v5 flows."
7
7
  s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: logstash-codec-sflow
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.3.0
4
+ version: 0.4.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Nicolas Fraison
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2015-12-14 00:00:00.000000000 Z
11
+ date: 2015-12-15 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  requirement: !ruby/object:Gem::Requirement