logstash-filter-combine 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 74854f535d2cff3da5922968879b506cd422079b1a954847fa17d3de2e0c7e27
+  data.tar.gz: 060c9733adbd9976c04fe233b6ee392287a362cbc51e61fd56f1ce58d1a88076
+SHA512:
+  metadata.gz: c9a7f8e010731c9b37f408df373364c0192d83e3f220945678e854a0099521d434630358bb686013eb06bd65967368011096bd0b42b31fc1454440b814bc5f2b
+  data.tar.gz: 83733bb0957c3d954437cb152cf1c8b74cb7055681465365631921634b48bd09159e7b414ea9f8613712442e1a8484a5c466bab156da727cdcdeac234e6a665b

data/CHANGELOG.md

@@ -0,0 +1,2 @@
+## 0.1.0
+  - Init release

data/CONTRIBUTORS

@@ -0,0 +1,3 @@
+Contributors:
+* Julian Wecke (securitym0nkey)
+

data/Gemfile

@@ -0,0 +1,10 @@
+source 'https://rubygems.org'
+gemspec
+
+logstash_path = ENV['LOGSTASH_PATH'] || '/usr/share/logstash'
+
+if Dir.exist?(logstash_path)
+  gem 'logstash-core', :path => "#{logstash_path}/logstash-core"
+  gem 'logstash-core-plugin-api', :path => "#{logstash_path}/logstash-core-plugin-api"
+end
+

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Julian Wecke
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,24 @@
+# Logstash Combine Filter Plugin
+
+This is a plugin for [Logstash](https://github.com/elastic/logstash).
+
+It is fully free and fully open source. The license is [MIT](LICENSE).
+
+
+## Documentation
+This filter plugin combines multiple source fields into one array.
+
+
+### Example config
+
+To create an array of source1, source2 and source3 under combine_target
+
+```
+filter {
+ combine {
+  target => "combine_target"
+  sources => ["source1","source2", "source3"]
+ }
+}
+
+```

data/lib/logstash/filters/combine.rb

@@ -0,0 +1,51 @@
+# encoding: utf-8
+require "logstash/filters/base"
+
+# This combine filter will replace the contents of the default
+# message field with whatever you specify in the configuration.
+#
+# It is only intended to be used as an combine.
+
+class LogStash::Filters::Combine < LogStash::Filters::Base
+
+  # filter {
+  #   combine {
+  #     target => "targetfield"
+  #     sources => ["sourcefield1","sourcefield2"]
+  #   }
+  # }
+  #
+  config_name "combine"
+
+  #Replace the message with this value.
+  #config :message, :validate => :string, :default => "Hello World!"
+
+  config :sources, :validate => :array
+  config :target, :validate => :string
+  config :remove_sources, :validate => :boolean, :default => false
+
+  public
+  def register
+    # Add instance variables
+  end # def register
+
+  public
+  def filter(event)
+
+    arr = []
+
+    @sources.each do |field|
+      data = event.get(field)
+      if !data.nil?
+       arr << data
+       event.remove(field) if @remove_sources
+      end
+    end
+
+    if arr.length() > 0
+      event.set(@target, arr)
+      filter_matched(event)
+    end
+
+  end # def filter
+end # class LogStash::Filters::Combine

data/logstash-filter-combine.gemspec

@@ -0,0 +1,23 @@
+Gem::Specification.new do |s|
+  s.name          = 'logstash-filter-combine'
+  s.version       = '0.1.0'
+  s.licenses      = ['MIT']
+  s.summary       = 'Logstash Filter Plugin to combine fields into an array'
+  s.description   = 'A logstash filter for combining multiple source fields into a target array.'
+  s.homepage      = 'https://github.com/securitym0nkey/logstash-filter-combine'
+  s.authors       = ['Julian Wecke']
+  s.email         = 'julian@wecke.me'
+  s.require_paths = ['lib']
+
+  # Files
+  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
+   # Tests
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
+  s.add_development_dependency 'logstash-devutils', '~> 0'
+end

data/spec/filters/combine_spec.rb

@@ -0,0 +1,21 @@
+# encoding: utf-8
+require_relative '../spec_helper'
+require "logstash/filters/combine"
+
+describe LogStash::Filters::Combine do
+  describe "Set to Hello World" do
+    let(:config) do <<-CONFIG
+      filter {
+        combine {
+          message => "Hello World"
+        }
+      }
+    CONFIG
+    end
+
+    sample("message" => "some text") do
+      expect(subject).to include("message")
+      expect(subject.get('message')).to eq('Hello World')
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,18 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require "logstash/devutils/rspec/spec_helper"

metadata

@@ -0,0 +1,84 @@
+--- !ruby/object:Gem::Specification
+name: logstash-filter-combine
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Julian Wecke
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2024-05-13 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: logstash-core-plugin-api
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: logstash-devutils
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0'
+description: A logstash filter for combining multiple source fields into a target
+  array.
+email: julian@wecke.me
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- CONTRIBUTORS
+- Gemfile
+- LICENSE
+- README.md
+- lib/logstash/filters/combine.rb
+- logstash-filter-combine.gemspec
+- spec/filters/combine_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/securitym0nkey/logstash-filter-combine
+licenses:
+- MIT
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: filter
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.3.25
+signing_key:
+specification_version: 4
+summary: Logstash Filter Plugin to combine fields into an array
+test_files:
+- spec/filters/combine_spec.rb
+- spec/spec_helper.rb