logstash-codec-zylog 1.0.6

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 8489c5a0265f37a193a04049f530a682af9fa867
+  data.tar.gz: 4635a4cd1eb6992bdb33e0f8a55106fd905ea0d2
+SHA512:
+  metadata.gz: fb51523acf7a88105bbaee4ab8b4503f6c21e0e73650c334c1737b8cbb2d5a538b678d65a3f45ec03545c4d89f21040e5ce0d92ee7d47b279852c2987a1cc20b
+  data.tar.gz: 822b974b2f16d32d5ab2eb1e72dc8aa2cd8c825ad5e402a7c26c2feef5c04f2ffbddd10c1422c91e0f670d1387d90d887c1d0f91e5059daffb2217d46e931309

data/CHANGELOG.md

@@ -0,0 +1,11 @@
+## 1.0.3
+  - Fix some documentation issues
+
+## 1.0.1
+ - Speed improvement, better exception handling and code refactoring
+
+## 1.0.0
+ - Update to v5.0 API
+
+## 0.1.2
+ - First version of this plugin

data/CONTRIBUTORS

@@ -0,0 +1,12 @@
+The following is a list of people who have contributed ideas, code, bug
+reports, or in general have helped logstash along its way.
+
+Contributors:
+* Inga Feick (ingafeick)
+* Nicolai Schulten (krakenfuss)
+
+
+Note: If you've sent us patches, bug reports, or otherwise contributed to
+Logstash, and you aren't on the list above and want to be, please let us know
+and we'll make sure you're here. Contributions from folks like you are what make
+open source awesome.

data/DEVELOPER.md

@@ -0,0 +1,2 @@
+# logstash-codec-protobuf
+No special instructions!

data/Gemfile

@@ -0,0 +1,11 @@
+source 'https://rubygems.org'
+
+gemspec
+
+logstash_path = ENV["LOGSTASH_PATH"] || "../../logstash"
+use_logstash_source = ENV["LOGSTASH_SOURCE"] && ENV["LOGSTASH_SOURCE"].to_s == "1"
+
+if Dir.exist?(logstash_path) && use_logstash_source
+  gem 'logstash-core', :path => "#{logstash_path}/logstash-core"
+  gem 'logstash-core-plugin-api', :path => "#{logstash_path}/logstash-core-plugin-api"
+end

data/LICENSE

@@ -0,0 +1,203 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright (c) 2012–2016 Elasticsearch http://www.elastic.co
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

data/NOTICE.TXT

@@ -0,0 +1,4 @@
+Copyright (c) 2012-2016 Elasticsearch
+
+This product includes software developed by The Apache Software
+Foundation (http://www.apache.org/).

data/README.md

@@ -0,0 +1,77 @@
+# Logstash zylog codec
+
+This is a codec plugin for [Logstash](https://github.com/elastic/logstash) to parse protobuf messages.
+
+# Prerequisites and Installation
+ 
+* prepare your ruby versions of the protobuf definitions, for example using the ruby-protoc compiler from https://github.com/codekitchen/ruby-protocol-buffers
+* download the [gem file](https://rubygems.org/gems/logstash-codec-protobuf) to your computer.
+* Install the plugin. From within your logstash directory, do
+	bin/plugin install /path/to/logstash-codec-protobuf-$VERSION.gem
+* use the codec in your logstash config file. See details below.
+
+## Configuration
+
+include_path  (required): an array of strings with filenames or directory names where logstash can find your protobuf definitions. Please provide absolute paths. For directories it will only try to import files ending on .rb
+
+class_name    (required): the name of the protobuf class that is to be decoded or encoded.
+
+## Usage example: decoder
+
+Use this as a codec in any logstash input. Just provide the name of the class that your incoming objects will be encoded in, and specify the path to the compiled definition.
+Here's an example for a kafka input:
+
+	kafka 
+  	{
+      zk_connect => "127.0.0.1"
+      topic_id => "unicorns_protobuffed"
+      codec => protobuf 
+      {
+        class_name => "Unicorn"
+        include_path => ['/my/path/to/compiled/protobuf/definitions/UnicornProtobuf.pb.rb']
+      }
+  	}   
+
+### Example with referenced definitions
+
+Imagine you have the following protobuf relationship: class Cheese lives in namespace Foods::Dairy and uses another class Milk. 
+
+	module Foods
+  		module Dairy
+    		class Cheese
+    			set_fully_qualified_name "Foods.Dairy.Cheese"
+			    optional ::Foods::Cheese::Milk, :milk, 1
+			    optional :int64, :unique_id, 2
+			    # here be more field definitions
+
+Make sure to put the referenced Milk class first in the include_path:
+
+	include_path => ['/path/to/protobuf/definitions/Milk.pb.rb','/path/to/protobuf/definitions/Cheese.pb.rb']
+
+Set the class name to the parent class:
+	
+	class_name => "Foods::Dairy::Cheese"
+
+## Usage example: encoder
+
+The configuration of the codec for encoding logstash events for a protobuf output is pretty much the same as for the decoder input usage as demonstrated above. There are some constraints though that you need to be aware of:
+* the protobuf definition needs to contain all the fields that logstash typically adds to an event, in the corrent data type. Examples for this are @timestamp (string), @version (string), host, path, all of which depend on your input sources and filters aswell. If you do not want to add those fields to your protobuf definition then please use a [modify filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html) to [remove](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-remove_field) the undesired fields.
+* object members starting with @ are somewhat problematic in protobuf definitions. Therefore those fields will automatically be renamed to remove the at character. This also effects the important @timestamp field. Please name it just "timestamp" in your definition.
+
+
+## Troubleshooting
+
+### "uninitialized constant SOME_CLASS_NAME"
+
+If you include more than one definition class, consider the order of inclusion. This is especially relevant if you include whole directories. A definition might refer to another definition that is not loaded yet. In this case, please specify the files in the include_path variable in reverse order of reference. See 'Example with referenced definitions' above.
+
+### no protobuf output
+
+Maybe your protobuf definition does not fullfill the requirements and needs additional fields. Run logstash with the --debug flag and grep for "error 2".
+
+
+## Limitations and roadmap
+
+* maybe add support for setting undefined fields from default values in the decoder
+
+

data/docs/index.asciidoc

@@ -0,0 +1,106 @@
+:plugin: protobuf
+:type: codec
+
+///////////////////////////////////////////
+START - GENERATED VARIABLES, DO NOT EDIT!
+///////////////////////////////////////////
+:version: %VERSION%
+:release_date: %RELEASE_DATE%
+:changelog_url: %CHANGELOG_URL%
+:include_path: ../../../../logstash/docs/include
+///////////////////////////////////////////
+END - GENERATED VARIABLES, DO NOT EDIT!
+///////////////////////////////////////////
+
+[id="plugins-{type}s-{plugin}"]
+
+=== Protobuf codec plugin
+
+include::{include_path}/plugin_header.asciidoc[]
+
+==== Description
+
+This codec converts protobuf encoded messages into logstash events and vice versa. 
+
+Requires the protobuf definitions as ruby files. You can create those using the [ruby-protoc compiler](https://github.com/codekitchen/ruby-protocol-buffers).
+
+The following shows a usage example for decoding events from a kafka stream:
+[source,ruby]
+kafka 
+{
+ zk_connect => "127.0.0.1"
+ topic_id => "your_topic_goes_here"
+ codec => protobuf 
+ {
+   class_name => "Animal::Unicorn"
+   include_path => ['/path/to/protobuf/definitions/UnicornProtobuf.pb.rb']
+ }
+}
+
+
+[id="plugins-{type}s-{plugin}-options"]
+==== Protobuf Codec Configuration Options
+
+[cols="<,<,<",options="header",]
+|=======================================================================
+|Setting |Input type|Required
+| <<plugins-{type}s-{plugin}-class_name>> |<<string,string>>|Yes
+| <<plugins-{type}s-{plugin}-include_path>> |<<array,array>>|Yes
+|=======================================================================
+
+&nbsp;
+
+[id="plugins-{type}s-{plugin}-class_name"]
+===== `class_name` 
+
+  * This is a required setting.
+  * Value type is <<string,string>>
+  * There is no default value for this setting.
+
+Name of the class to decode.
+If your protobuf definition contains modules, prepend them to the class name with double colons like so:
+[source,ruby]
+class_name => "Foods::Dairy::Cheese"
+
+This corresponds to a protobuf definition starting as follows:
+[source,ruby]
+module Foods
+   module Dairy
+       class Cheese
+           # here are your field definitions.
+
+If your class references other definitions: you only have to add the main class here.
+
+[id="plugins-{type}s-{plugin}-include_path"]
+===== `include_path` 
+
+  * This is a required setting.
+  * Value type is <<array,array>>
+  * There is no default value for this setting.
+
+List of absolute pathes to files with protobuf definitions. 
+When using more than one file, make sure to arrange the files in reverse order of dependency so that each class is loaded before it is 
+refered to by another.
+
+Example: a class _Cheese_ referencing another protobuf class _Milk_
+[source,ruby]
+module Foods
+  module Dairy
+        class Cheese
+           set_fully_qualified_name "Foods.Dairy.Cheese"
+           optional ::Foods::Cheese::Milk, :milk, 1
+           optional :int64, :unique_id, 2
+           # here be more field definitions
+
+would be configured as
+[source,ruby]
+include_path => ['/path/to/protobuf/definitions/Milk.pb.rb','/path/to/protobuf/definitions/Cheese.pb.rb']
+
+When using the codec in an output plugin: 
+* make sure to include all the desired fields in the protobuf definition, including timestamp. 
+  Remove fields that are not part of the protobuf definition from the event by using the mutate filter.
+* the @ symbol is currently not supported in field names when loading the protobuf definitions for encoding. Make sure to call the timestamp field "timestamp" 
+  instead of "@timestamp" in the protobuf file. Logstash event fields will be stripped of the leading @ before conversion.
+ 
+
+

data/lib/logstash/codecs/zylog.rb

@@ -0,0 +1,235 @@
+# encoding: utf-8
+require 'logstash/codecs/base'
+require 'logstash/util/charset'
+require 'protocol_buffers' # https://github.com/codekitchen/ruby-protocol-buffers
+
+# This codec converts protobuf encoded messages into logstash events and vice versa. 
+#
+# Requires the protobuf definitions as ruby files. You can create those using the [ruby-protoc compiler](https://github.com/codekitchen/ruby-protocol-buffers).
+# 
+# The following shows a usage example for decoding events from a kafka stream:
+# [source,ruby]
+# kafka 
+# {
+#  zk_connect => "127.0.0.1"
+#  topic_id => "your_topic_goes_here"
+#  codec => protobuf 
+#  {
+#    class_name => "Animal::Unicorn"
+#    include_path => ['/path/to/protobuf/definitions/UnicornProtobuf.pb.rb']
+#  }
+# }
+#
+
+class LogStash::Codecs::Zylog < LogStash::Codecs::Base
+  config_name 'zylog'
+
+  # Name of the class to decode.
+  # If your protobuf definition contains modules, prepend them to the class name with double colons like so:
+  # [source,ruby]
+  # class_name => "Foods::Dairy::Cheese"
+  # 
+  # This corresponds to a protobuf definition starting as follows:
+  # [source,ruby]
+  # module Foods
+  #    module Dairy
+  #        class Cheese
+  #            # here are your field definitions.
+  # 
+  # If your class references other definitions: you only have to add the main class here.
+  config :class_name, :validate => :string, :required => true
+
+  # List of absolute pathes to files with protobuf definitions. 
+  # When using more than one file, make sure to arrange the files in reverse order of dependency so that each class is loaded before it is 
+  # refered to by another.
+  # 
+  # Example: a class _Cheese_ referencing another protobuf class _Milk_
+  # [source,ruby]
+  # module Foods
+  #   module Dairy
+  #         class Cheese
+  #            set_fully_qualified_name "Foods.Dairy.Cheese"
+  #            optional ::Foods::Cheese::Milk, :milk, 1
+  #            optional :int64, :unique_id, 2
+  #            # here be more field definitions
+  #
+  # would be configured as
+  # [source,ruby]
+  # include_path => ['/path/to/protobuf/definitions/Milk.pb.rb','/path/to/protobuf/definitions/Cheese.pb.rb']
+  #
+  # When using the codec in an output plugin: 
+  # * make sure to include all the desired fields in the protobuf definition, including timestamp. 
+  #   Remove fields that are not part of the protobuf definition from the event by using the mutate filter.
+  # * the @ symbol is currently not supported in field names when loading the protobuf definitions for encoding. Make sure to call the timestamp field "timestamp" 
+  #   instead of "@timestamp" in the protobuf file. Logstash event fields will be stripped of the leading @ before conversion.
+  #  
+  config :include_path, :validate => :array, :required => true
+
+
+  def register
+    @pb_metainfo = {}
+    include_path.each { |path| require_pb_path(path) }
+    @obj = create_object_from_name(class_name)
+    @logger.debug("Zylog files successfully loaded.")
+  end
+
+
+  def decode(data)
+    begin
+      @logger.debug("data class type: #{data.class}.")
+      @logger.debug("receive data length: #{data.length}.")
+      if data.length >= 5
+        payload = data.bytes.to_a
+        @logger.debug("receive data byte 1th-5th: #{payload[0]} #{payload[1]} #{payload[2]} #{payload[3]} #{payload[4]}")
+        total_packet_length = (payload[4].ord) + (payload[3].ord << 8) + (payload[2].ord << 16) + (payload[1].ord << 24)
+        @logger.debug("total packet length: #{total_packet_length}.")
+        if data.length >= total_packet_length
+          data = data.slice(5, total_packet_length - 5 - 1)
+          @logger.debug("after extract receive data length: #{data.length}.")
+        else
+          raise(StandardError, "packet to small, length: #{data.length}.")
+        end
+      else
+        raise(StandardError, "packet to small, length: #{data.length}.")
+      end
+
+      decoded = @obj.parse(data.to_s)
+      yield LogStash::Event.new(decoded.to_hash) if block_given?
+    rescue => e
+      @logger.warn("Couldn't decode protobuf: #{e.inspect}.")
+      # raise e
+    end
+  end # def decode
+
+
+  def encode(event)
+    protobytes = generate_protobuf(event)
+    @on_event.call(event, protobytes)
+  end # def encode
+
+
+  private
+  def generate_protobuf(event)
+    begin
+      data = _encode(event, @class_name)
+      msg = @obj.new(data)
+      msg.serialize_to_string
+    rescue NoMethodError
+      @logger.debug("error 2: NoMethodError. Maybe mismatching protobuf definition. Required fields are: " + event.to_hash.keys.join(", "))
+    rescue => e
+      @logger.debug("Couldn't generate protobuf: ${e}")
+    end
+  end
+
+
+  def _encode(datahash, class_name)
+    fields = prepare_for_encoding(datahash)    
+    meta = get_complex_types(class_name) # returns a hash with member names and their protobuf class names
+    meta.map do | (k,typeinfo) |
+      if fields.include?(k)
+        original_value = fields[k] 
+        proto_obj = create_object_from_name(typeinfo)
+        fields[k] = 
+          if original_value.is_a?(::Array)
+            # make this field an array/list of protobuf objects
+            # value is a list of hashed complex objects, each of which needs to be protobuffed and
+            # put back into the list.
+            original_value.map { |x| _encode(x, typeinfo) } 
+            original_value
+          else 
+            recursive_fix = _encode(original_value, class_name)
+            proto_obj.new(recursive_fix)
+          end # if is array
+      end
+    end    
+    fields
+  end
+
+
+  def prepare_for_encoding(datahash)
+    # the data cannot be encoded until certain criteria are met:
+    # 1) remove @ signs from keys 
+    # 2) convert timestamps and other objects to strings
+    next unless datahash.is_a?(::Hash)    
+    ::Hash[datahash.map{|(k,v)| [remove_atchar(k.to_s), (convert_to_string?(v) ? v.to_s : v)] }]
+  end
+
+
+  def convert_to_string?(v)
+    !(v.is_a?(Fixnum) || v.is_a?(::Hash) || v.is_a?(::Array) || [true, false].include?(v))
+  end
+
+   
+  def remove_atchar(key) # necessary for @timestamp fields and the likes. Zylog definition doesn't handle @ in field names well.
+    key.dup.gsub(/@/,'')
+  end
+
+  
+  def create_object_from_name(name)
+    begin
+      @logger.debug("Creating instance of " + name)
+      name.split('::').inject(Object) { |n,c| n.const_get c }
+     end
+  end
+
+  def get_complex_types(class_name)
+    @pb_metainfo[class_name]
+  end
+
+  def require_with_metadata_analysis(filename)
+    require filename
+    regex_class_name = /\s*class\s*(?<name>.+?)\s+/
+    regex_module_name = /\s*module\s*(?<name>.+?)\s+/
+    regex_pbdefs = /\s*(optional|repeated)(\s*):(?<type>.+),(\s*):(?<name>\w+),(\s*)(?<position>\d+)/
+    # now we also need to find out which class it contains and the protobuf definitions in it.
+    # We'll unfortunately need that later so that we can create nested objects.
+    begin 
+      class_name = ""
+      type = ""
+      field_name = ""
+      classname_found = false
+      File.readlines(filename).each do |line|
+        if ! (line =~ regex_module_name).nil? && !classname_found # because it might be declared twice in the file
+          class_name << $1 
+          class_name << "::"
+    
+        end
+        if ! (line =~ regex_class_name).nil? && !classname_found # because it might be declared twice in the file
+          class_name << $1
+          @pb_metainfo[class_name] = {}
+          classname_found = true
+        end
+        if ! (line =~ regex_pbdefs).nil?
+          type = $1
+          field_name = $2
+          if type =~ /::/
+            @pb_metainfo[class_name][field_name] = type.gsub!(/^:/,"")
+            
+          end
+        end
+      end
+    rescue Exception => e
+      @logger.warn("error 3: unable to read pb definition from file  " + filename+ ". Reason: #{e.inspect}. Last settings were: class #{class_name} field #{field_name} type #{type}. Backtrace: " + e.backtrace.inspect.to_s)
+    end
+    if class_name.nil?
+      @logger.warn("error 4: class name not found in file  " + filename)
+    end    
+  end
+
+  def require_pb_path(dir_or_file)
+    f = dir_or_file.end_with? ('.rb')
+    begin
+      if f
+        @logger.debug("Including protobuf file: " + dir_or_file)
+        require_with_metadata_analysis dir_or_file
+      else 
+        Dir[ dir_or_file + '/*.rb'].each { |file|
+          @logger.debug("Including protobuf path: " + dir_or_file + "/" + file)
+          require_with_metadata_analysis file 
+        }
+      end
+    end
+  end
+
+
+end # class LogStash::Codecs::Zylog

data/logstash-codec-zylog.gemspec

@@ -0,0 +1,26 @@
+Gem::Specification.new do |s|
+
+  s.name            = 'logstash-codec-zylog'
+  s.version         = '1.0.6'
+  s.licenses        = ['Apache-2.0']
+  s.summary         = "This codec may be used to decode (via inputs) and encode (via outputs) protobuf messages"
+  s.description     = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
+  s.authors         = ["Inga Feick"]
+  s.email           = 'inga.feick@trivago.com'
+  s.require_paths   = ["lib"]
+
+  # Files
+  s.files = Dir["lib/**/*","spec/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "vendor/jar-dependencies/**/*.jar", "vendor/jar-dependencies/**/*.rb", "VERSION", "docs/**/*"]
+
+  # Tests
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "codec" }
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
+  s.add_runtime_dependency 'ruby-protocol-buffers' # used by the compiled version of our protobuf definition. 
+  s.add_development_dependency 'logstash-devutils'
+end
+

data/spec/codecs/zylog_spec.rb

@@ -0,0 +1,205 @@
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"
+require "logstash/codecs/zylog"
+require "logstash/event"
+require 'protocol_buffers' # https://github.com/codekitchen/ruby-protocol-buffers
+require "insist"
+
+describe LogStash::Codecs::Zylog do
+
+
+  context "#decode" do
+
+
+    #### Test case 1: Decode simple protobuf bytes for unicorn ####################################################################################################################
+    let(:plugin_unicorn) { LogStash::Codecs::zylog.new("class_name" => "Animal::Unicorn", "include_path" => ['spec/helpers/unicorn.pb.rb'])  }
+    before do
+        plugin_unicorn.register      
+    end
+
+    it "should return an event from protobuf encoded data" do
+    
+      data = {:colour => 'rainbow', :horn_length => 18, :last_seen => 1420081471, :has_wings => true}
+      unicorn = Animal::Unicorn.new(data)
+        
+      plugin_unicorn.decode(unicorn.serialize_to_string) do |event|
+        expect(event.get("colour") ).to eq(data[:colour] )
+        expect(event.get("horn_length") ).to eq(data[:horn_length] )
+        expect(event.get("last_seen") ).to eq(data[:last_seen] )
+        expect(event.get("has_wings") ).to eq(data[:has_wings] )
+      end
+    end # it
+
+
+
+    #### Test case 2: Decode complex protobuf bytes for human #####################################################################################################################
+
+
+  
+ 
+    let(:plugin_human) { LogStash::Codecs::Zylog.new("class_name" => "Animal::Human", "include_path" => ['spec/helpers/human.pb.rb'])  }
+    before do
+        plugin_human.register      
+    end
+
+    it "should return an event from complex nested protobuf encoded data" do
+    
+      data_gm = {:first_name => 'Elisabeth', :last_name => "Oliveoil", :middle_names => ["Maria","Johanna"], :vegetarian=>true}
+      grandmother = Animal::Human.new(data_gm)
+      data_m = {:first_name => 'Annemarie', :last_name => "Smørebrød", :mother => grandmother}
+      mother = Animal::Human.new(data_m)
+      data_f = {:first_name => 'Karl', :middle_names => ["Theodor-Augustin"], :last_name => "Falkenstein"}
+      father = Animal::Human.new(data_f)
+      data = {:first_name => 'Hugo', :middle_names => ["Heinz", "Peter"], :last_name => "Smørebrød",:father => father, :mother => mother}  
+      hugo = Animal::Human.new(data)
+       
+      plugin_human.decode(hugo.serialize_to_string) do |event|
+        expect(event.get("first_name") ).to eq(data[:first_name] )
+        expect(event.get("middle_names") ).to eq(data[:middle_names] )
+        expect(event.get("last_name") ).to eq(data[:last_name] )
+        expect(event.get("[mother][first_name]") ).to eq(data_m[:first_name] ) 
+        expect(event.get("[father][first_name]") ).to eq(data_f[:first_name] )
+        expect(event.get("[mother][last_name]") ).to eq(data_m[:last_name] )
+        expect(event.get("[mother][mother][last_name]") ).to eq(data_gm[:last_name] )
+        expect(event.get("[mother][mother][first_name]") ).to eq(data_gm[:first_name] )
+        expect(event.get("[mother][mother][middle_names]") ).to eq(data_gm[:middle_names] )
+        expect(event.get("[mother][mother][vegetarian]") ).to eq(data_gm[:vegetarian] )
+        expect(event.get("[father][last_name]") ).to eq(data_f[:last_name] )
+        expect(event.get("[father][middle_names]") ).to eq(data_f[:middle_names] )
+      end
+    end # it
+
+
+
+
+
+
+    #### Test case 3: Decoder test for enums #####################################################################################################################
+
+
+  
+ 
+    let(:plugin_col) { LogStash::Codecs::Zylog.new("class_name" => "ColourProtoTest", "include_path" => ['spec/helpers/ColourTestcase.pb.rb'])  }
+    before do
+        plugin_col.register      
+    end
+
+    it "should return an event from protobuf encoded data with enums" do
+    
+      data = {:least_liked => ColourProtoTest::Colour::YELLOW, :favourite_colours => \
+        [ColourProtoTest::Colour::BLACK, ColourProtoTest::Colour::BLUE], :booleantest => [true, false, true]}  
+      pb = ColourProtoTest.new(data)
+       
+      plugin_col.decode(pb.serialize_to_string) do |event|
+        expect(event.get("least_liked") ).to eq(data[:least_liked] )
+        expect(event.get("favourite_colours") ).to eq(data[:favourite_colours] )
+        expect(event.get("booleantest") ).to eq(data[:booleantest] )
+      end
+    end # it
+
+
+  end # context
+
+
+
+
+
+  #### Test case 4: Encode simple protobuf bytes for unicorn ####################################################################################################################
+
+  context "#encode" do
+    subject do
+      next LogStash::Codecs::Zylog.new("class_name" => "Animal::UnicornEvent", "include_path" => ['spec/helpers/unicorn_event.pb.rb'])
+    end
+
+    event = LogStash::Event.new("colour" => "pink", "horn_length" => 12, "last_seen" => 1410081999, "has_wings" => true)    
+
+    it "should return protobuf encoded data from a simple event" do
+      subject.on_event do |event, data|
+        insist { data.is_a? String }
+        unicorn = Animal::UnicornEvent.parse(data) 
+    
+        expect(unicorn.colour ).to eq(event.get("colour") )
+        expect(unicorn.horn_length ).to eq(event.get("horn_length") )
+        expect(unicorn.last_seen ).to eq(event.get("last_seen") )
+        expect(unicorn.has_wings ).to eq(event.get("has_wings") )
+      
+      end # subject.on_event
+      subject.encode(event)
+    end # it
+  end # context
+
+
+
+
+  #### Test case 5: encode complex protobuf bytes for human #####################################################################################################################
+  
+  
+  context "#encode2" do
+    subject do
+      next LogStash::Codecs::Zylog.new("class_name" => "Animal::Human", "include_path" => ['spec/helpers/human.pb.rb'])
+    end
+
+    event = LogStash::Event.new("first_name" => "Jimmy", "middle_names" => ["Bob", "James"], "last_name" => "Doe" \
+      , "mother" => {"first_name" => "Jane", "middle_names" => ["Elizabeth"], "last_name" => "Doe" , "age" => 83, "vegetarian"=> false} \
+      , "father" => {"first_name" => "John", "last_name" => "Doe", "@email" => "character_replacement_test@nothing" })    
+
+    it "should return protobuf encoded data from a complex event" do
+
+      subject.on_event do |event, data|
+        insist { data.is_a? String }
+        jimmy = Animal::Human.parse(data) 
+        
+        expect(jimmy.first_name ).to eq(event.get("first_name") )
+        expect(jimmy.middle_names ).to eq(event.get("middle_names") )
+        expect(jimmy.last_name ).to eq(event.get("last_name") )
+        expect(jimmy.mother.first_name ).to eq(event.get("[mother][first_name]") )
+        expect(jimmy.father.first_name ).to eq(event.get("[father][first_name]") )
+        expect(jimmy.mother.middle_names ).to eq(event.get("[mother][middle_names]") )
+        expect(jimmy.mother.age ).to eq(event.get("[mother][age]") ) # recursion test for values
+        expect(jimmy.mother.vegetarian ).to eq(event.get("[mother][vegetarian]") ) # recursion test for values
+        expect(jimmy.father.last_name ).to eq(event.get("[father][last_name]") )
+        expect(jimmy.father.email ).to eq(event.get("[father][@email]") ) # recursion test for keys
+        expect(jimmy.mother.last_name ).to eq(event.get("[mother][last_name]") )
+      
+      end # subject.on_event
+      subject.encode(event)
+    end # it
+  end # context
+
+
+
+
+
+  #### Test case 6: encode enums #########################################################################################################################
+  
+
+ 
+  context "#encode3" do
+    subject do
+      next LogStash::Codecs::Zylog.new("class_name" => "ColourProtoTest", "include_path" => ['spec/helpers/ColourTestcase.pb.rb'])
+    end
+
+    require 'spec/helpers/ColourTestcase.pb.rb' # otherwise we cant use the colour enums in the next line
+    event = LogStash::Event.new("booleantest" =>  [false, false, true], "least_liked" => ColourProtoTest::Colour::YELLOW,  "favourite_colours" => \
+       [ColourProtoTest::Colour::BLACK, ColourProtoTest::Colour::BLUE] )    
+
+    it "should return protobuf encoded data from a complex event with enums" do
+
+      subject.on_event do |event, data|
+        insist { data.is_a? String }
+
+        colpref = ColourProtoTest.parse(data) 
+        
+        expect(colpref.booleantest ).to eq(event.get("booleantest") )
+        expect(colpref.least_liked ).to eq(event.get("least_liked") )
+        expect(colpref.favourite_colours ).to eq(event.get("favourite_colours") )
+
+      
+      end # subject.on_event
+      subject.encode(event)
+    end # it
+  end # context
+
+
+
+end

data/spec/helpers/ColourTestcase.pb.rb

@@ -0,0 +1,35 @@
+#!/usr/bin/env ruby
+# Generated by the protocol buffer compiler. DO NOT EDIT!
+
+require 'protocol_buffers'
+
+# forward declarations
+class ColourProtoTest < ::ProtocolBuffers::Message; end
+
+class ColourProtoTest < ::ProtocolBuffers::Message
+  # forward declarations
+
+  # enums
+  module Colour
+    include ::ProtocolBuffers::Enum
+
+    set_fully_qualified_name "ColourProtoTest.Colour"
+
+    BLACK = 0
+    BLUE = 1
+    WHITE = 2
+    GREEN = 3
+    RED = 4
+    YELLOW = 5
+    AQUA = 6
+  end
+
+  set_fully_qualified_name "ColourProtoTest"
+
+  repeated ::ColourProtoTest::Colour, :favourite_colours, 1
+  repeated :bool, :booleantest, 2
+  optional ::ColourProtoTest::Colour, :least_liked, 3
+  optional :string, :timestamp, 4
+  optional :string, :version, 5
+end
+

data/spec/helpers/ColourTestcase.proto

@@ -0,0 +1,24 @@
+
+
+message ColourProtoTest {
+
+    enum Colour {
+          BLACK = 0;
+          BLUE = 1;
+          WHITE = 2;
+          GREEN = 3;
+          RED = 4;
+          YELLOW = 5;
+          AQUA = 6;
+
+      }
+
+    // most liked colours; test enums in arrays.
+    repeated Colour favourite_colours = 1;
+
+    // why not also test booleans in arrays while we're at it. 
+    repeated bool booleantest = 2; 
+
+    // least liked colour
+    optional Colour least_liked = 3;
+}

data/spec/helpers/human.pb.rb

@@ -0,0 +1,26 @@
+#!/usr/bin/env ruby
+# Generated by the protocol buffer compiler. DO NOT EDIT!
+
+require 'protocol_buffers'
+
+module Animal
+  # forward declarations
+  class Human < ::ProtocolBuffers::Message; end
+
+  class Human < ::ProtocolBuffers::Message
+    set_fully_qualified_name "animal.Human"
+
+    optional :string, :first_name, 1
+    repeated :string, :middle_names, 2
+    optional :string, :last_name, 3
+    optional ::Animal::Human, :mother, 4
+    optional ::Animal::Human, :father, 5
+    optional :string, :path, 6
+    optional :string, :version, 7
+    optional :string, :timestamp, 8
+    optional :string, :email, 9
+    optional :bool, :vegetarian, 10
+    optional :int32, :age, 11
+  end
+
+end

data/spec/helpers/unicorn.pb.rb

@@ -0,0 +1,19 @@
+#!/usr/bin/env ruby
+# Generated by the protocol buffer compiler. DO NOT EDIT!
+
+require 'protocol_buffers'
+
+module Animal
+  # forward declarations
+  class Unicorn < ::ProtocolBuffers::Message; end
+
+  class Unicorn < ::ProtocolBuffers::Message
+    set_fully_qualified_name "animal.Unicorn"
+
+    optional :string, :colour, 1
+    optional :int32, :horn_length, 2
+    optional :int32, :last_seen, 3
+    optional :bool, :has_wings, 4
+  end
+
+end

data/spec/helpers/unicorn_event.pb.rb

@@ -0,0 +1,24 @@
+#!/usr/bin/env ruby
+# Generated by the protocol buffer compiler. DO NOT EDIT!
+
+require 'protocol_buffers'
+
+module Animal
+  # forward declarations
+  class UnicornEvent < ::ProtocolBuffers::Message; end
+
+  class UnicornEvent < ::ProtocolBuffers::Message
+    set_fully_qualified_name "animal.UnicornEvent"
+
+    optional :string, :colour, 1
+    optional :int32, :horn_length, 2
+    optional :int32, :last_seen, 3
+    optional :string, :timestamp, 4
+    optional :string, :host, 5
+    optional :string, :path, 6
+    optional :string, :version, 7
+    optional :bool, :has_wings, 8
+    
+  end
+
+end

metadata

@@ -0,0 +1,118 @@
+--- !ruby/object:Gem::Specification
+name: logstash-codec-zylog
+version: !ruby/object:Gem::Version
+  version: 1.0.6
+platform: ruby
+authors:
+- Inga Feick
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2018-07-03 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.60'
+    - - "<="
+      - !ruby/object:Gem::Version
+        version: '2.99'
+  name: logstash-core-plugin-api
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.60'
+    - - "<="
+      - !ruby/object:Gem::Version
+        version: '2.99'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  name: ruby-protocol-buffers
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  name: logstash-devutils
+  prerelease: false
+  type: :development
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: This gem is a logstash plugin required to be installed on top of the
+  Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not
+  a stand-alone program
+email: inga.feick@trivago.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- CONTRIBUTORS
+- DEVELOPER.md
+- Gemfile
+- LICENSE
+- NOTICE.TXT
+- README.md
+- docs/index.asciidoc
+- lib/logstash/codecs/zylog.rb
+- logstash-codec-zylog.gemspec
+- spec/codecs/zylog_spec.rb
+- spec/helpers/ColourTestcase.pb.rb
+- spec/helpers/ColourTestcase.proto
+- spec/helpers/human.pb.rb
+- spec/helpers/unicorn.pb.rb
+- spec/helpers/unicorn_event.pb.rb
+homepage:
+licenses:
+- Apache-2.0
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: codec
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project:
+rubygems_version: 2.6.14.1
+signing_key:
+specification_version: 4
+summary: This codec may be used to decode (via inputs) and encode (via outputs) protobuf
+  messages
+test_files:
+- spec/codecs/zylog_spec.rb
+- spec/helpers/ColourTestcase.pb.rb
+- spec/helpers/ColourTestcase.proto
+- spec/helpers/human.pb.rb
+- spec/helpers/unicorn.pb.rb
+- spec/helpers/unicorn_event.pb.rb