logstash-codec-sflow 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5074ee2cb3fc307fe88e094cec33ae46d17ba96b
-  data.tar.gz: f22772698c0de3757d7428d954effedc9cd21d1e
+  metadata.gz: e71a4aa268b76cca9b65e5dc1aad8e122258dd9a
+  data.tar.gz: 38517dcb9ac05475b3d99571637487901ec71665
 SHA512:
-  metadata.gz: a028d13f047b1d5c4a92a0b2507e07e2c064ee408577d86a9eb219595e48ad8b51c4111568af5918a0dc1f6c6e9a6f4736333e214c7407d159775ea0855a7a9f
-  data.tar.gz: 8d811f0bfbff45fae54c52dbb3384789207145e6b4bbb2288ecc02dd61f0e2bc95c88934ba6e500ba92d8635e6394cd62307504d0e73e126e99c4ac688abea41
+  metadata.gz: baa6c2ed01de48b5bb54b5648c8293d061c5ed04900704be77552e64b9ec9ca9a5c5303d863e46fd2aafc155edd745fc3af6f1874ab2b943fc7d5c3e28fe578f
+  data.tar.gz: e99fec0d9e43c09e7f4773d05fc0510617831219803e4173faba3da5d8eee97b04f02fabccd82407c412f14caab7411b52a531cad62b9618009a98c166595c0d

data/README.md

@@ -14,6 +14,55 @@ For the counter flow it is able to decode some records of type:
 - Processor Information
 - HTTP
 
+## TO DO
+Currently this plugin does not manage all sflow counter and is not able to decode
+all kind of protocols.
+If needed you can aks for some to be added.
+Please provide a pcap file containing the sflow events of the counter/protocol
+to add in order to be able to implement it.
+
+## Human Readable Protocol
+In order to translate protocols value to a human readable protocol, you can use the
+logstash-filter-translate plugin
+```
+filter {
+      translate {
+        field => protocol
+        dictionary => [ "1", "ETHERNET",
+                        "11", "IP"
+                      ]
+        fallback => "UNKNOWN"
+        destination => protocol
+        override => true
+      }
+      translate {
+        field => eth_type
+        dictionary => [ "2048", "IP",
+                        "33024", "802.1Q VLAN"
+                      ]
+        fallback => "UNKNOWN"
+        destination => eth_type
+        override => true
+      }
+      translate {
+        field => vlan_type
+        dictionary => [ "2048", "IP"
+                      ]
+        fallback => "UNKNOWN"
+        destination => vlan_type
+        override => true
+      }
+      translate {
+        field => ip_protocol
+        dictionary => [ "6", "TCP",
+                        "17", "UDP"
+                      ]
+        fallback => "UNKNOWN"
+        destination => ip_protocol
+        override => true
+      }
+}
+```
 
 [![Build
 Status](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Codecs/job/logstash-plugin-codec-example-unit/badge/icon)](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Codecs/job/logstash-plugin-codec-example-unit/)

data/lib/logstash/codecs/sflow.rb

@@ -10,14 +10,14 @@ class LogStash::Codecs::Sflow < LogStash::Codecs::Base
   config :versions, :validate => :array, :default => [5]
 
   # Specify which sflow fields must not be send in the event
-  config :optional_removed_field, :validate => :array, :default => %w(sflow_version ip_version header_size
+  config :optional_removed_field, :validate => :array, :default => %w(sflow_version header_size
  ip_header_length ip_dscp ip_ecn ip_total_length ip_identification ip_flags ip_fragment_offset ip_ttl ip_checksum
  ip_options tcp_seq_number tcp_ack_number tcp_header_length tcp_reserved tcp_is_nonce tcp_is_cwr tcp_is_ecn_echo
  tcp_is_urgent tcp_is_ack tcp_is_push tcp_is_reset tcp_is_syn tcp_is_fin tcp_window_size tcp_checksum
  tcp_urgent_pointer tcp_options vlan_cfi sequence_number flow_sequence_number vlan_type udp_length udp_checksum)
 
   # Specify if codec must perform SNMP call so agent_ip for interface resolution.
-  config :snmp_interface, :validate => :boolean, :default => true
+  config :snmp_interface, :validate => :boolean, :default => false
 
   # Specify if codec must perform SNMP call so agent_ip for interface resolution.
   config :snmp_community, :validate => :string, :default => 'public'
@@ -141,7 +141,7 @@ class LogStash::Codecs::Sflow < LogStash::Codecs::Base
 
         events.push(event)
 
-        #treat counter flow
+      #treat counter flow
       elsif sample['sample_entreprise'] == 0 && sample['sample_format'] == 2
         sample['sample_data']['records'].each do |record|
           # Ensure that some data exist for the record
@@ -170,4 +170,4 @@ class LogStash::Codecs::Sflow < LogStash::Codecs::Base
       yield event
     end
   end # def decode
-end # class LogStash::Filters::Sflow
+end # class LogStash::Filters::Sflow

data/logstash-codec-sflow.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name = 'logstash-codec-sflow'
-  s.version = '1.0.0'
+  s.version = '1.1.0'
   s.licenses = ['Apache License (2.0)']
   s.summary = 'The sflow codec is for decoding SFlow v5 flows.'
   s.description = 'This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program'
@@ -21,7 +21,7 @@ Gem::Specification.new do |s|
 
   # Gem dependencies
   s.add_runtime_dependency 'logstash-core', '>= 1.4.0', '< 3.0.0'
-  s.add_runtime_dependency 'bindata', ['>= 2.1.0']
+  s.add_runtime_dependency 'bindata', ['>= 2.3.0']
   s.add_runtime_dependency 'lru_redux', ['>= 1.1.0']
   s.add_runtime_dependency 'snmp', ['>= 1.2.0']
   s.add_development_dependency 'logstash-devutils'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-codec-sflow
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Nicolas Fraison
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2016-02-14 00:00:00.000000000 Z
+date: 2016-08-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -35,7 +35,7 @@ dependencies:
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: 2.3.0
   name: bindata
   prerelease: false
   type: :runtime
@@ -43,7 +43,7 @@ dependencies:
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: 2.3.0
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
     requirements: