logstash-filter-cusum 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 64a5fa67125f35c297dc402bc56ea221042c42d7841896f4a03629e309d55fe5
+  data.tar.gz: 514bb1b7df4ac0da8150394b332ea0bda95382c7338abd89b61cee5a9c846198
+SHA512:
+  metadata.gz: b43e61e5b60f44c4234dff8a7d1bb958e0748b646d4d356c507e6e781b2a67ada101f6e8bc2cee3ed6f5758bc9a119685a146bb9a05c9ed3e8df3fd6b4269961
+  data.tar.gz: d130133e617ea4001180dee860f8021e02b2569b3dcb42b3840553799541590d9f18101ac1c0a934e3505268f0c1f903172826556460640590391776cdf81209

data/CHANGELOG.md

@@ -0,0 +1,3 @@
+## 0.1.0
+  - Plugin created with the logstash plugin generator
+  - First implementation

data/Gemfile

@@ -0,0 +1,5 @@
+source 'https://rubygems.org'
+gem 'rack'
+gem 'rspec'
+gemspec
+

data/LICENSE

@@ -0,0 +1,11 @@
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

data/README.md

@@ -0,0 +1,58 @@
+# Logstash cumulative sum filter
+*Was developed and tested with logstash 7.6*
+
+This is a plugin for [Logstash](https://github.com/elastic/logstash). 
+
+It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.
+
+## Documentation
+
+This plugin is used to do a simple cumulative sum. It has 3 simple parameters:
+1. **fields** *[array, required]* this contains the name of the fields that will contain the current cumulative sum value
+1. **add_values** *[hash]* a dictionary that indicates the value to add for each field. Defaults to 0
+1. **initial_values** *[hash]* a dictionary that indicates the value to use if no stored value is found. Defaults to 0
+
+You can use it in this simple way:
+```
+filter {
+  cusum{
+    fields => ["apples","bananas"]
+    add_values => {
+        "apples"  => "%{apples_to_add}"
+        "bananas" => "-2"
+      }
+    initial_values => {
+        "bananas" => "%{[default_bananas]}"
+      }
+  }
+}	
+```
+
+## How to install
+
+### 1. From gem file
+- Download the latest gemfile from releases
+
+- Install in logstash
+```
+/bin/logstash-plugin install /path/to/gem/logstash-filter-cumsumm-<version>.gem
+```
+
+- Run logstash and have fun
+
+### 2. Build it yourself
+- To get started, you'll need JRuby with the Bundler gem installed.
+
+- Clone or download this repo
+
+- Install dependencies
+```
+bundle install
+```
+
+- compile gem file
+```
+gem build logstash-filter-example.gemspec
+```
+
+- Install the plugin as in **1.**

data/lib/logstash/filters/cusum.rb

@@ -0,0 +1,84 @@
+# encoding: utf-8
+require "logstash/filters/base"
+
+# This  filter will take make a cumulative sum based on given add_values dictionary.
+# The first value will be taken from the initial_values dictionary. The filter
+# then takes the stored value (or initial value if there's no stored value yet) and adds
+# what is in the add_values dictionary. If there is no add_value 0 is added.
+# 
+# If there is no initial_value for a given field 0 will be used
+#
+# Usage:
+#
+# filter {
+#   cusum{
+#     fields => ["apples","bananas"]
+#     add_values => {
+#         "apples"  => "%{[apples_to_add]}"
+#         "bananas" => "%{[bananas_to_add]}"
+#       }
+#     initial_values => {
+#         "apples"  => "0"
+#         "bananas" => "%{[default_bananas]}"
+#       }
+#   }
+# }
+
+class LogStash::Filters::Cusum < LogStash::Filters::Base
+  config_name "cusum"
+
+  # Define filter values: fields, add_values and initial_values
+  config :fields, :validate => :array, :required => true
+
+  config :add_values, :validate => :hash, :required => false
+
+  config :initial_values, :validate => :hash, :required => false 
+
+  public
+  def register
+    @cusum = Hash.new
+    @logger.debug? && @logger.debug("[cusum] Creating locally stored hash")
+  end # def register
+
+  public
+  def filter(event)
+    @logger.debug? && @logger.debug("[cusum] Applying cusum filter")
+
+    @fields.each do |field|
+      # take the value from the map
+      val = @cusum[field]
+
+      if val.nil?
+        if @initial_values.nil? # if there is no initial_values we set current value to 0
+          val = 0
+        else # if there is no value stored yet set it to the starting value. If there is no given starting value, our own default is 0
+          val = @initial_values[field].nil? ? 0 : event.sprintf(@initial_values[field]).to_i #NO CHECK ON  validity :'( 
+        end
+      end # val.nil?
+
+      @logger.debug? && @logger.debug("[cusum] cusum value for #{field} was #{val}")
+
+      
+      if @add_values.nil? # If there is no add_values we set to_add to 0 (no change)
+        to_add = 0
+      else # Take the to_add value from values to add. If no value is specified we add 0 (no change)
+        to_add = @add_values[field].nil? ? 0 : event.sprintf(@add_values[field]).to_i #NO CHECK ON  validity :'(     
+      end
+      
+      @logger.debug? && @logger.debug("[cusum] value to add for #{field} is #{to_add}")
+
+      # Store in the map the sum
+      @cusum[field] = val + to_add
+
+      @logger.debug? && @logger.debug("[cusum] cusum value for #{field} isn now #{@cusum[field]}")
+
+      # Set on the event the field with the cusum value. Overriding any current value
+      event.set(field,@cusum[field])
+      
+      @logger.debug? && @logger.debug("[cusum] set event field #{field} to #{@cusum[field]}")
+
+    end # @fields.each do
+    # filter_matched should go in the last line of our successful code
+    filter_matched(event)
+  end # def filter
+end # class LogStash::Filters::Cusum

data/logstash-filter-cusum.gemspec

@@ -0,0 +1,23 @@
+Gem::Specification.new do |s|
+  s.name          = 'logstash-filter-cusum'
+  s.version       = '0.1.0'
+  s.licenses      = ['Apache-2.0']
+  s.summary       = 'The cusum filter performs a cumulative sum'
+  s.description   = 'This filter does a cumulative sum and overrides event fields with its value'
+  s.homepage      = 'https://github.com/deletX/logstash-filter-cusum'
+  s.authors       = ['Stefano Gavioli']
+  s.email         = 'stefano@stefanogavioli.eu'
+  s.require_paths = ['lib']
+
+  # Files
+  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
+   # Tests
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99" 
+  s.add_development_dependency 'logstash-devutils'
+end

data/spec/filters/cusum_spec.rb

@@ -0,0 +1,23 @@
+# encoding: utf-8
+# TODO: make tests
+require_relative '../spec_helper'
+require "logstash/filters/cusum"
+
+describe LogStash::Filters::Cusum do
+  describe "Add 1" do
+    let(:config) do <<-CONFIG
+      filter {
+        cusum {
+          fields => ["some_field"]
+          add_values => {"some_field" => "%{[value]}"}
+        }
+      }
+    CONFIG
+    end
+
+    sample("value" => "1") do
+      expect(subject).to include("some_field")
+      expect(subject.get('some_field')).to eq(1)
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,2 @@
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"

metadata

@@ -0,0 +1,89 @@
+--- !ruby/object:Gem::Specification
+name: logstash-filter-cusum
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Stefano Gavioli
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2021-03-05 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.60'
+    - - "<="
+      - !ruby/object:Gem::Version
+        version: '2.99'
+  name: logstash-core-plugin-api
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.60'
+    - - "<="
+      - !ruby/object:Gem::Version
+        version: '2.99'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  name: logstash-devutils
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: This filter does a cumulative sum and overrides event fields with its
+  value
+email: stefano@stefanogavioli.eu
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- Gemfile
+- LICENSE
+- README.md
+- lib/logstash/filters/cusum.rb
+- logstash-filter-cusum.gemspec
+- spec/filters/cusum_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/deletX/logstash-filter-cusum
+licenses:
+- Apache-2.0
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: filter
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.0.6
+signing_key:
+specification_version: 4
+summary: The cusum filter performs a cumulative sum
+test_files:
+- spec/filters/cusum_spec.rb
+- spec/spec_helper.rb