logstash-codec-sflow 0.7.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0aaf8697b6cb76a42460d46e16e1422407a058be
-  data.tar.gz: 8b52a11e6c10be918f32c315d6fe7379e9530024
+  metadata.gz: 777103af0e2e6781f0f898e676d4115b218256ed
+  data.tar.gz: 807d579c592cd093afecdaa54ac591468030e4ae
 SHA512:
-  metadata.gz: 368a1f5bd98367c76ea40cc0d03af0420295b96a8a4aebc6d9d402b12b8c1bd90e84242f2a28da0106cabb5f55e8580fbfe908dc8cb0e99d7f4e43e87ae29efe
-  data.tar.gz: d708b1577d239473b523e37f8de5102cbeb3131cc228a965ebe711c628390e2a8383c80f07841023e418579db7e816fab3856cb8061496ff19ba083de05bed32
+  metadata.gz: 0b2460db2ea2d55506fd30ac0e240c52681fa718e073b3f691759aa6ac32c5d89a0991a272cddbffbce957855d93f04996034d58df20cc6bc7d4073ff8d8ad0c
+  data.tar.gz: 8c11363eb68c6959b29241f911c4827e1e3cde18ae1a9c0e0fd0f7c2a12418f6d4601fa264712acbf11a645e917f92cbed17515ee5a9ee3d054506bc5d7a5c78

data/lib/logstash/codecs/sflow.rb

@@ -6,6 +6,9 @@ require 'logstash/namespace'
 class LogStash::Codecs::Sflow < LogStash::Codecs::Base
   config_name 'sflow'
 
+  # Specify which Sflow versions you will accept.
+  config :versions, :validate => :array, :default => [5]
+
   # Specify which sflow must not be send in the event
   config :optional_removed_field, :validate => :array, :default => %w(sflow_version ip_version header_size ip_header_length ip_dscp ip_ecn ip_total_length ip_identification ip_flags ip_fragment_offset ip_ttl ip_checksum ip_options tcp_seq_number tcp_ack_number tcp_header_length tcp_reserved tcp_is_nonce tcp_is_cwr tcp_is_ecn_echo tcp_is_urgent tcp_is_ack tcp_is_push tcp_is_reset tcp_is_syn tcp_is_fin tcp_window_size tcp_checksum tcp_urgent_pointer tcp_options)
 
@@ -22,7 +25,7 @@ class LogStash::Codecs::Sflow < LogStash::Codecs::Base
   def assign_key_value(event, bindata_kv)
     bindata_kv.each_pair do |k, v|
       unless @removed_field.include? k.to_s
-        event["#{k}"] = v
+        event["#{k.to_s}"] = v.to_s
       end
     end
   end
@@ -48,6 +51,11 @@ class LogStash::Codecs::Sflow < LogStash::Codecs::Base
 
   public
   def decode(payload)
+    header = SFlowHeader.read(payload)
+    unless @versions.include?(header.sflow_version)
+      @logger.warn("Ignoring Sflow version v#{header.sflow_version}")
+      return
+    end
 
     decoded = SFlow.read(payload)
 
@@ -83,6 +91,10 @@ class LogStash::Codecs::Sflow < LogStash::Codecs::Base
           end
 
         end
+        #compute frame_length_times_sampling_rate
+        if event.include?('frame_length') and event.include?('sampling_rate')
+          event["frame_length_times_sampling_rate"] = event['frame_length'].to_i * event['sampling_rate'].to_i
+        end
         events.push(event)
 
         #treat counter flow
@@ -108,4 +120,4 @@ class LogStash::Codecs::Sflow < LogStash::Codecs::Base
       yield event
     end
   end # def decode
-end # class LogStash::Filters::Sflow
+end # class LogStash::Filters::Sflow

data/lib/logstash/codecs/sflow/datagram.rb

@@ -4,6 +4,12 @@ require 'bindata'
 require 'logstash/codecs/sflow/util'
 require 'logstash/codecs/sflow/sample'
 
+
+class SFlowHeader < BinData::Record
+  endian :big
+  uint32 :sflow_version
+end
+
 # noinspection RubyResolve
 class SFlow < BinData::Record
   endian :big

data/logstash-codec-sflow.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name = 'logstash-codec-sflow'
-  s.version = '0.7.0'
+  s.version = '0.8.0'
   s.licenses = ['Apache License (2.0)']
   s.summary = "The sflow codec is for decoding SFlow v5 flows."
   s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-codec-sflow
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.8.0
 platform: ruby
 authors:
 - Nicolas Fraison
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2015-12-18 00:00:00.000000000 Z
+date: 2015-12-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement