logstash-event 1.1.5 → 1.2.02

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright 2009-2011 Jordan Sissel, Pete Fritchman, and contributors.
+Copyright 2009-2013 Jordan Sissel, Pete Fritchman, and contributors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

data/lib/logstash-event.rb

@@ -1,3 +1 @@
 require "logstash/event"
-require "logstash/version"
-

data/lib/logstash/event.rb

@@ -1,45 +1,85 @@
 require "json"
-require "logstash/time"
-require "logstash/namespace"
-require "uri"
 require "time"
+require "date"
+require "logstash/namespace"
+require "logstash/util/fieldreference"
+
+# Use a custom serialization for jsonifying Time objects.
+# TODO(sissel): Put this in a separate file.
+class Time
+  def to_json(*args)
+    return iso8601(3).to_json(*args)
+  end
+
+  def inspect
+    return to_json
+  end
+end
 
-# General event type. 
-# Basically a light wrapper on top of a hash.
+# the logstash event object.
+#
+# An event is simply a tuple of (timestamp, data).
+# The 'timestamp' is an ISO8601 timestamp. Data is anything - any message,
+# context, references, etc that are relevant to this event.
+#
+# Internally, this is represented as a hash with only two guaranteed fields.
+#
+# * "@timestamp" - an ISO8601 timestamp representing the time the event
+#   occurred at.
+# * "@version" - the version of the schema. Currently "1"
+#
+# They are prefixed with an "@" symbol to avoid clashing with your
+# own custom fields. 
+#
+# When serialized, this is represented in JSON. For example:
 #
-# TODO(sissel): properly handle lazy properties like parsed time formats, urls,
-# etc, as necessary.
+#     {
+#       "@timestamp": "2013-02-09T20:39:26.234Z",
+#       "@version": "1",
+#       message: "hello world"
+#     }
 class LogStash::Event
+  class DeprecatedMethod < StandardError; end
+
   public
-  def initialize(data=nil)
+  def initialize(data={})
     @cancelled = false
 
-    @data = {
-      "@source" => "unknown",
-      "@tags" => [],
-      "@fields" => {},
-    }
-    @data.merge!(data) unless data.nil?
-    @data["@timestamp"] ||= LogStash::Time.now
+    @data = data
+    if data.include?("@timestamp")
+      t = data["@timestamp"]
+      if t.is_a?(String)
+        data["@timestamp"] = Time.parse(t).gmtime
+      end
+    else
+      data["@timestamp"] = ::Time.now.utc 
+    end
+    data["@version"] = "1" if !@data.include?("@version")
   end # def initialize
 
-  if RUBY_ENGINE == "jruby"
-    @@date_parser = Java::org.joda.time.format.ISODateTimeFormat.dateTimeParser.withOffsetParsed
-  else
-    # TODO(sissel): LOGSTASH-217
-    @@date_parser ||= nil
-  end
-
+  # Add class methods on inclusion.
   public
-  def self.from_json(json)
-    return LogStash::Event.new(JSON.parse(json))
-  end # def self.from_json
+  def self.included(klass)
+    klass.extend(ClassMethods)
+  end # def included
+
+  module ClassMethods
+    public
+    def from_json(json)
+      return self.new(JSON.parse(json))
+    end # def from_json
+  end
 
   public
   def cancel
     @cancelled = true
   end # def cancel
 
+  public
+  def uncancel
+    @cancelled = false
+  end # def uncancel
+
   public
   def cancelled?
     return @cancelled
@@ -48,95 +88,90 @@ class LogStash::Event
   # Create a deep-ish copy of this event.
   public
   def clone
-    newdata = @data.clone
-    newdata["@fields"] = {}
-    fields.each do |k,v|
-      newdata["@fields"][k] = v.clone
+    copy = {}
+    @data.each do |k,v|
+      # TODO(sissel): Recurse if this is a hash/array?
+      copy[k] = v.clone
     end
-    return LogStash::Event.new(newdata)
+    return self.class.new(copy)
   end # def clone
 
-  public
-  def to_s
-    return self.sprintf("%{@timestamp} %{@source}: %{@message}")
-  end # def to_s
-
-  public
-  def timestamp; @data["@timestamp"]; end # def timestamp
-  def timestamp=(val); @data["@timestamp"] = val; end # def timestamp=
-
-  public
-  def unix_timestamp
-    if RUBY_ENGINE != "jruby"
-      # This is really slow. See LOGSTASH-217
-      return Time.parse(timestamp).to_f
-    else
-      time = @@date_parser.parseDateTime(timestamp)
-      return time.getMillis.to_f / 1000
-    end
+  if RUBY_ENGINE == "jruby"
+    public
+    def to_s
+      return self.sprintf("%{+yyyy-MM-dd'T'HH:mm:ss.SSSZ} %{host} %{message}")
+    end # def to_s
+  else
+    public
+    def to_s
+      return self.sprintf("#{self["@timestamp"].iso8601} %{host} %{message}")
+    end # def to_s
   end
 
   public
-  def source; @data["@source"]; end # def source
-  def source=(val) 
-    uri = URI.parse(val) rescue nil
-    val = uri if uri
-    if val.is_a?(URI)
-      @data["@source"] = val.to_s
-      @data["@source_host"] = val.host
-      @data["@source_path"] = val.path
-    else
-      @data["@source"] = val
-      @data["@source_host"] = val
-    end
-  end # def source=
-
-  public
-  def source_host; @data["@source_host"]; end # def source_host
-  def source_host=(val); @data["@source_host"] = val; end # def source_host=
-
-  public
-  def source_path; @data["@source_path"]; end # def source_path
-  def source_path=(val); @data["@source_path"] = val; end # def source_path=
-
-  public
-  def message; @data["@message"]; end # def message
-  def message=(val); @data["@message"] = val; end # def message=
-
-  public
-  def type; @data["@type"]; end # def type
-  def type=(val); @data["@type"] = val; end # def type=
+  def timestamp; return @data["@timestamp"]; end # def timestamp
+  def timestamp=(val); return @data["@timestamp"] = val; end # def timestamp=
 
-  public
-  def tags; @data["@tags"]; end # def tags
-  def tags=(val); @data["@tags"] = val; end # def tags=
+  def unix_timestamp
+    raise DeprecatedMethod
+  end # def unix_timestamp
 
+  def ruby_timestamp
+    raise DeprecatedMethod
+  end # def unix_timestamp
+  
   # field-related access
   public
-  def [](key)
-    # If the key isn't in fields and it starts with an "@" sign, get it out of data instead of fields
-    if ! @data["@fields"].has_key?(key) and key.slice(0,1) == "@"
-      return @data[key]
-    # Exists in @fields (returns value) or doesn't start with "@" (return null)
+  def [](str)
+    if str[0,1] == "+"
     else
-      return @data["@fields"][key]
+      return LogStash::Util::FieldReference.exec(str, @data)
     end
   end # def []
   
   public
-  def []=(key, value)
-    if @data.has_key?(key)
-      @data[key] = value
-    else
-      @data["@fields"][key] = value
+  def []=(str, value)
+    r = LogStash::Util::FieldReference.exec(str, @data) do |obj, key|
+      obj[key] = value
     end
+
+    # The assignment can fail if the given field reference (str) does not exist
+    # In this case, we'll want to set the value manually.
+    if r.nil?
+      # TODO(sissel): Implement this in LogStash::Util::FieldReference
+      if str[0,1] != "["
+        return @data[str] = value
+      end
+
+      # No existing element was found, so let's set one.
+      *parents, key = str.scan(/(?<=\[)[^\]]+(?=\])/)
+      obj = @data
+      parents.each do |p|
+        if obj.include?(p)
+          obj = obj[p]
+        else
+          obj[p] = {}
+          obj = obj[p]
+        end
+      end
+      obj[key] = value
+    end
+    return value
   end # def []=
 
-  def fields; return @data["@fields"] end # def fields
+  public
+  def fields
+    raise DeprecatedMethod
+  end
   
   public
-  def to_json(*args); return @data.to_json(*args) end # def to_json
-  def to_hash; return @data end # def to_hash
+  def to_json(*args)
+    return @data.to_json(*args) 
+  end # def to_json
+
+  def to_hash
+    return @data
+  end # def to_hash
 
   public
   def overwrite(event)
@@ -145,45 +180,22 @@ class LogStash::Event
 
   public
   def include?(key)
-    return (@data.include?(key) or @data["@fields"].include?(key))
+    return !self[key].nil?
   end # def include?
 
   # Append an event to this one.
   public
   def append(event)
-    if event.message
-      if self.message
-        self.message += "\n" + event.message 
-      else
-        self.message = event.message
-      end
-    end
-    self.tags |= event.tags
+    # non-destructively merge that event with ourselves.
+    LogStash::Util.hash_merge(@data, event.to_hash)
+  end # append
 
-    # Append all fields
-    event.fields.each do |name, value|
-      if self.fields.include?(name)
-        if !self.fields[name].is_a?(Array)
-          self.fields[name] = [self.fields[name]]
-        end
-        if value.is_a?(Array)
-          self.fields[name] |= value
-        else
-          self.fields[name] << value unless self.fields[name].include?(value)
-        end
-      else
-        self.fields[name] = value
-      end
-    end # event.fields.each
-  end # def append
-
-  # Remove a field
+  # Remove a field or field reference. Returns the value of that field when
+  # deleted
   public
-  def remove(field)
-    if @data.has_key?(field)
-      @data.delete(field)
-    else
-      @data["@fields"].delete(field)
+  def remove(str)
+    return LogStash::Util::FieldReference.exec(str, @data) do |obj, key|
+      next obj.delete(key)
     end
   end # def remove
 
@@ -192,9 +204,9 @@ class LogStash::Event
   # any format values, delimited by %{foo} where 'foo' is a field or
   # metadata member.
   #
-  # For example, if the event has @type == "foo" and @source == "bar"
+  # For example, if the event has type == "foo" and source == "bar"
   # then this string:
-  #   "type is %{@type} and source is %{@source}"
+  #   "type is %{type} and source is %{host}"
   # will return
   #   "type is foo and source is bar"
   #
@@ -205,6 +217,7 @@ class LogStash::Event
   # is an array (or hash?) should be. Join by comma? Something else?
   public
   def sprintf(format)
+    format = format.to_s
     if format.index("%").nil?
       return format
     end
@@ -215,69 +228,45 @@ class LogStash::Event
 
       if key == "+%s"
         # Got %{+%s}, support for unix epoch time
-        if RUBY_ENGINE != "jruby"
-          # This is really slow. See LOGSTASH-217
-          Date.parse(self.timestamp).to_i
-        else
-          datetime = @@date_parser.parseDateTime(self.timestamp)
-          (datetime.getMillis / 1000).to_i
-        end
+        next @data["@timestamp"].to_i
       elsif key[0,1] == "+"
-        # We got a %{+TIMEFORMAT} so use joda to format it.
-        if RUBY_ENGINE != "jruby"
-          # This is really slow. See LOGSTASH-217
-          datetime = Date.parse(self.timestamp)
-          format = key[1 .. -1]
-          datetime.strftime(format)
-        else
-          datetime = @@date_parser.parseDateTime(self.timestamp)
-          format = key[1 .. -1]
-          datetime.toString(format) # return requested time format
-        end
+        t = @data["@timestamp"]
+        formatter = org.joda.time.format.DateTimeFormat.forPattern(key[1 .. -1])\
+          .withZone(org.joda.time.DateTimeZone::UTC)
+        #next org.joda.time.Instant.new(t.tv_sec * 1000 + t.tv_usec / 1000).toDateTime.toString(formatter)
+        # Invoke a specific Instant constructor to avoid this warning in JRuby
+        #  > ambiguous Java methods found, using org.joda.time.Instant(long)
+        org.joda.time.Instant.java_class.constructor(Java::long).new_instance(
+          t.tv_sec * 1000 + t.tv_usec / 1000
+        ).to_java.toDateTime.toString(formatter)
       else
-        # Use an event field.
-        value = nil
-        obj = self
-
-        # If the top-level value exists, use that and don't try
-        # to "look" into data structures.
-        if self[key]
-          value = self[key]
-        else
-          # "." is what ES uses to access structured data, so adopt that
-          # idea here, too.  "foo.bar" will access key "bar" under hash "foo".
-          key.split('.').each do |segment|
-            if obj
-              value = obj[segment] rescue nil
-              obj = obj[segment] rescue nil
-            else
-              value = nil
-              break
-            end
-          end # key.split.each
-        end # if self[key]
-
+        value = self[key]
         case value
-        when nil
-          tok # leave the %{foo} if this field does not exist in this event.
-        when Array
-          value.join(",") # Join by ',' if value is an array
-        when Hash
-          value.to_json # Convert hashes to json
-        else
-          value # otherwise return the value
-        end
-      end
-    end
+          when nil
+            tok # leave the %{foo} if this field does not exist in this event.
+          when Array
+            value.join(",") # Join by ',' if value is an array
+          when Hash
+            value.to_json # Convert hashes to json
+          else
+            value # otherwise return the value
+        end # case value
+      end # 'key' checking
+    end # format.gsub...
   end # def sprintf
 
-  public
-  def ==(other)
-    #puts "#{self.class.name}#==(#{other.inspect})"
-    if !other.is_a?(self.class)
-      return false
-    end
+  # Shims to remove after event v1 is the default.
+  def tags=(value); self["tags"] = value; end
+  def tags; return self["tags"]; end
+  def message=(value); self["message"] = value; end
+  def source=(value); self["source"] = value; end
+  def type=(value); self["type"] = value; end
+  def type; return self["type"]; end
+  def fields; return self.to_hash; end
 
-    return other.to_hash == self.to_hash
-  end # def ==
+  def tag(value)
+    # Generalize this method for more usability
+    self["tags"] ||= []
+    self["tags"] << value unless self["tags"].include?(value)
+  end
 end # class LogStash::Event

data/lib/logstash/namespace.rb

@@ -1,4 +1,4 @@
-$: << File.join(File.dirname(__FILE__), "..", "..", "vendor", "bundle")
+#$: << File.join(File.dirname(__FILE__), "..", "..", "vendor", "bundle")
 
 module LogStash
   module Inputs; end
@@ -9,6 +9,7 @@ module LogStash
   module File; end
   module Web; end
   module Util; end
+  module PluginMixins; end
 
   SHUTDOWN = :shutdown
 end # module LogStash

data/lib/logstash/util.rb

@@ -0,0 +1,105 @@
+require "logstash/namespace"
+
+module LogStash::Util
+  UNAME = case RbConfig::CONFIG["host_os"]
+    when /^linux/; "linux"
+    else; RbConfig::CONFIG["host_os"]
+  end
+
+  PR_SET_NAME = 15
+  def self.set_thread_name(name)
+    if RUBY_ENGINE == "jruby"
+      # Keep java and ruby thread names in sync.
+      Java::java.lang.Thread.currentThread.setName(name)
+    end
+    Thread.current[:name] = name
+    
+    if UNAME == "linux"
+      require "logstash/util/prctl"
+      # prctl PR_SET_NAME allows up to 16 bytes for a process name
+      # since MRI 1.9, JRuby, and Rubinius use system threads for this.
+      LibC.prctl(PR_SET_NAME, name[0..16], 0, 0, 0)
+    end
+  end # def set_thread_name
+
+  # Merge hash 'src' into 'dst' nondestructively
+  #
+  # Duplicate keys will become array values
+  #
+  # [ src["foo"], dst["foo"] ]
+  def self.hash_merge(dst, src)
+    src.each do |name, svalue|
+      if dst.include?(name)
+        dvalue = dst[name]
+        if dvalue.is_a?(Hash) && svalue.is_a?(Hash)
+          dvalue = hash_merge(dvalue, svalue)
+        elsif svalue.is_a?(Array) 
+          if dvalue.is_a?(Array)
+            # merge arrays without duplicates.
+            dvalue |= svalue
+          else
+            dvalue = [dvalue] | svalue
+          end
+        else
+          if dvalue.is_a?(Array)
+            dvalue << svalue unless dvalue.include?(svalue)
+          else
+            dvalue = [dvalue, svalue] unless dvalue == svalue
+          end
+        end
+
+        dst[name] = dvalue
+      else
+        # dst doesn't have this key, just set it.
+        dst[name] = svalue
+      end
+    end
+
+    return dst
+  end # def self.hash_merge
+ 
+  # Merge hash 'src' into 'dst' nondestructively
+  #
+  # Duplicate keys will become array values
+  # Arrays merged will simply be appended.
+  #
+  # [ src["foo"], dst["foo"] ]
+  def self.hash_merge_with_dups(dst, src)
+    src.each do |name, svalue|
+      if dst.include?(name)
+        dvalue = dst[name]
+        if dvalue.is_a?(Hash) && svalue.is_a?(Hash)
+          dvalue = hash_merge(dvalue, svalue)
+        elsif svalue.is_a?(Array) 
+          if dvalue.is_a?(Array)
+            # merge arrays without duplicates.
+            dvalue += svalue
+          else
+            dvalue = [dvalue] + svalue
+          end
+        else
+          if dvalue.is_a?(Array)
+            dvalue << svalue unless dvalue.include?(svalue)
+          else
+            dvalue = [dvalue, svalue] unless dvalue == svalue
+          end
+        end
+
+        dst[name] = dvalue
+      else
+        # dst doesn't have this key, just set it.
+        dst[name] = svalue
+      end
+    end
+
+    return dst
+  end # def self.hash_merge
+
+  def self.hash_merge_many(*hashes)
+    dst = {}
+    hashes.each do |hash|
+      hash_merge_with_dups(dst, hash)
+    end
+    return dst
+  end # def hash_merge_many
+end # module LogStash::Util

data/lib/logstash/util/fieldreference.rb

@@ -0,0 +1,49 @@
+require "logstash/namespace"
+require "logstash/util"
+
+module LogStash::Util::FieldReference
+  def compile(str)
+    if str[0,1] != '['
+      return <<-"CODE"
+        lambda do |e, &block|
+          return block.call(e, #{str.inspect}) unless block.nil?
+          return e[#{str.inspect}]
+        end
+      CODE
+    end
+
+    code = "lambda do |e, &block|\n"
+    selectors = str.scan(/(?<=\[).+?(?=\])/)
+    selectors.each_with_index do |tok, i|
+      last = (i == selectors.count() - 1)
+      code << "   # [#{tok}]#{ last ? " (last selector)" : "" }\n"
+     
+      if last
+        code << <<-"CODE"
+          return block.call(e, #{tok.inspect}) unless block.nil?
+        CODE
+      end
+
+      code << <<-"CODE"
+        if e.is_a?(Array)
+          e = e[#{tok.to_i}]
+        else
+          e = e[#{tok.inspect}]
+        end
+        return e if e.nil?
+      CODE
+      
+    end
+    code << "return e\nend"
+    #puts code
+    return code
+  end # def compile
+
+  def exec(str, obj, &block)
+    @__fieldeval_cache ||= {}
+    @__fieldeval_cache[str] ||= eval(compile(str))
+    return @__fieldeval_cache[str].call(obj, &block)
+  end
+
+  extend self
+end # module LogStash::Util::FieldReference

data/spec/event.rb

@@ -0,0 +1,139 @@
+require "logstash/event"
+require "insist"
+
+describe LogStash::Event do
+  subject do
+    LogStash::Event.new(
+      "@timestamp" => Time.iso8601("2013-01-01T00:00:00.000Z"),
+      "type" => "sprintf",
+      "message" => "hello world",
+      "tags" => [ "tag1" ],
+      "source" => "/home/foo",
+      "a" => "b", 
+      "c" => {
+        "d" => "f",
+        "e" => {"f" => "g"}
+      }, 
+      "f" => { "g" => { "h" => "i" } },
+      "j" => { 
+          "k1" => "v", 
+          "k2" => [ "w", "x" ],
+          "k3" => {"4" => "m"},
+          5 => 6,
+          "5" => 7
+      } 
+    )
+  end
+
+  context "#sprintf" do
+    it "should report a unix timestamp for %{+%s}" do
+      insist { subject.sprintf("%{+%s}") } == "1356998400"
+    end
+    
+    it "should report a time with %{+format} syntax", :if => RUBY_ENGINE == "jruby" do
+      insist { subject.sprintf("%{+YYYY}") } == "2013"
+      insist { subject.sprintf("%{+MM}") } == "01"
+      insist { subject.sprintf("%{+HH}") } == "00"
+    end
+  
+    it "should report fields with %{field} syntax" do
+      insist { subject.sprintf("%{type}") } == "sprintf"
+      insist { subject.sprintf("%{message}") } == subject["message"]
+    end
+    
+    it "should print deep fields" do
+      insist { subject.sprintf("%{[j][k1]}") } == "v"
+      insist { subject.sprintf("%{[j][k2][0]}") } == "w"
+    end
+
+    it "should be able to take a non-string for the format" do
+      insist { subject.sprintf(2) } == "2"
+    end
+  end
+  
+  context "#[]" do
+    it "should fetch data" do
+      insist { subject["type"] } == "sprintf"
+    end
+    it "should fetch fields" do
+      insist { subject["a"] } == "b"
+      insist { subject['c']['d'] } == "f"
+    end
+    it "should fetch deep fields" do
+      insist { subject["[j][k1]"] } == "v"
+      insist { subject["[c][d]"] } == "f"
+      insist { subject['[f][g][h]'] } == "i"
+      insist { subject['[j][k3][4]'] } == "m"
+      insist { subject['[j][5]'] } == 7
+
+    end
+
+    it "should be fast?", :if => ENV["SPEEDTEST"] do
+      2.times do
+        start = Time.now
+        100000.times { subject["[j][k1]"] }
+        puts "Duration: #{Time.now - start}"
+      end
+    end
+  end
+
+  context "#append" do
+    it "should append strings to an array" do
+      subject.append(LogStash::Event.new("message" => "another thing"))
+      insist { subject["message"] } == [ "hello world", "another thing" ]
+    end
+  
+    it "should concatenate tags" do
+      subject.append(LogStash::Event.new("tags" => [ "tag2" ]))
+      insist { subject["tags"] } == [ "tag1", "tag2" ]
+    end
+  
+    context "when event field is nil" do
+      it "should add single value as string" do
+        subject.append(LogStash::Event.new({"field1" => "append1"}))
+        insist { subject[ "field1" ] } == "append1"
+      end
+      it "should add multi values as array" do
+        subject.append(LogStash::Event.new({"field1" => [ "append1","append2" ]}))
+        insist { subject[ "field1" ] } == [ "append1","append2" ]
+      end
+    end
+  
+    context "when event field is a string" do
+      before { subject[ "field1" ] = "original1" }
+  
+      it "should append string to values, if different from current" do
+        subject.append(LogStash::Event.new({"field1" => "append1"}))
+        insist { subject[ "field1" ] } == [ "original1", "append1" ]
+      end
+      it "should not change value, if appended value is equal current" do
+        subject.append(LogStash::Event.new({"field1" => "original1"}))
+        insist { subject[ "field1" ] } == "original1"
+      end
+      it "should concatenate values in an array" do
+        subject.append(LogStash::Event.new({"field1" => [ "append1" ]}))
+        insist { subject[ "field1" ] } == [ "original1", "append1" ]
+      end
+      it "should join array, removing duplicates" do
+        subject.append(LogStash::Event.new({"field1" => [ "append1","original1" ]}))
+        insist { subject[ "field1" ] } == [ "original1", "append1" ]
+      end
+    end
+    context "when event field is an array" do
+      before { subject[ "field1" ] = [ "original1", "original2" ] }
+  
+      it "should append string values to array, if not present in array" do
+        subject.append(LogStash::Event.new({"field1" => "append1"}))
+        insist { subject[ "field1" ] } == [ "original1", "original2", "append1" ]
+      end
+      it "should not append string values, if the array already contains it" do
+        subject.append(LogStash::Event.new({"field1" => "original1"}))
+        insist { subject[ "field1" ] } == [ "original1", "original2" ]
+      end
+      it "should join array, removing duplicates" do
+        subject.append(LogStash::Event.new({"field1" => [ "append1","original1" ]}))
+        insist { subject[ "field1" ] } == [ "original1", "original2", "append1" ]
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: logstash-event
 version: !ruby/object:Gem::Version
-  version: 1.1.5
+  version: 1.2.02
   prerelease: 
 platform: ruby
 authors:
@@ -9,8 +9,72 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-11-12 00:00:00.000000000 Z
-dependencies: []
+date: 2013-09-11 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: guard
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: guard-rspec
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: insist
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.0.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.0.0
 description: Library that contains the classes required to create LogStash events
 email:
 - jls@semicomplete.com
@@ -21,8 +85,9 @@ files:
 - lib/logstash-event.rb
 - lib/logstash/event.rb
 - lib/logstash/namespace.rb
-- lib/logstash/time.rb
-- lib/logstash/version.rb
+- lib/logstash/util/fieldreference.rb
+- lib/logstash/util.rb
+- spec/event.rb
 - LICENSE
 homepage: https://github.com/logstash/logstash
 licenses:
@@ -45,7 +110,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.24
+rubygems_version: 1.8.25
 signing_key: 
 specification_version: 3
 summary: Library that contains the classes required to create LogStash events

data/lib/logstash/time.rb

@@ -1,32 +0,0 @@
-require "logstash/namespace"
-
-# Provide our own Time wrapper for ISO8601 support
-# Example:
-#   >> LogStash::Time.now.to_iso8601
-#   => "2010-10-17 00:25:24.619014-0700"
-#
-#   >> LogStash::Time.now.utc.to_iso8601
-#   => "2010-10-17 07:25:26.788704Z"
-module LogStash::Time
-  if RUBY_ENGINE == "jruby"
-    require "java"
-    DateTime = org.joda.time.DateTime
-    DateTimeZone = org.joda.time.DateTimeZone
-    def self.now
-      # org.joda.time.DateTime#to_s returns the time in ISO8601 form :)
-      # Could call DateTime.new(DateTimeZone::UTC) but JRuby calls the
-      # DateTime#new(Object) constructor instead of the
-      # DateTime#new(DateTimeZone) constructor. I was unable to get java_send to invoke this constructor,
-      # so instead I have to do DateTime#new#withZone(UTC)
-      return DateTime.new.withZone(DateTimeZone::UTC).to_s
-    end # def initialize
-  else
-    # Otherwise, use ruby stdlib Time, which is much slower than Joda.
-    ISO8601_STRFTIME = "%04d-%02d-%02dT%02d:%02d:%02d.%06d%+03d:00".freeze
-    def self.now
-      now = Time.new.utc
-      return sprintf(ISO8601_STRFTIME, now.year, now.month, now.day, now.hour,
-                     now.min, now.sec, now.tv_usec, now.utc_offset / 3600)
-    end
-  end
-end # module LogStash::Time

data/lib/logstash/version.rb

@@ -1,5 +0,0 @@
-# The version of logstash.
-LOGSTASH_VERSION = "1.1.5"
-
-# Note to authors: this should not include dashes because 'gem' barfs if
-# you include a dash in the version string.