logstash-filter-date 3.1.5 → 3.1.7

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 560d311715c0a4a9fd5dce66347ac0454e8a0f9b
4
- data.tar.gz: 16c331c55c8ee5473e7bd15b61cf984e3e02c26f
3
+ metadata.gz: fa8dba70e5fcdf7e55cab938957876b23729093a
4
+ data.tar.gz: 3361908b485cc02d455c1ca4b2b23e6c6bbc599d
5
5
  SHA512:
6
- metadata.gz: 4e2309227ddbc2945a328c27bf26bb2f3c48b86fe96797442bc919761079e1749282936532661923c225746699f7458529b1d2cd768d18d9e93f86513423d733
7
- data.tar.gz: 6c41b484930ee043e2b19bc5725f59312ae69c27a7b732ea2ebfeb5d38c1359fa87cbacaf6d9ddbff5e3af5947969e8f8333bacf7390551e3bf02388445afcd2
6
+ metadata.gz: 60e629d7a7dde483331a3a4517b8a3eb0e970ef1913f9624f3f8a82ed1f3f00c7d82ad45541409bafb6bae86e19bdc4975a1ddba2aee31c70e81d0816a7f4db7
7
+ data.tar.gz: ad2b9902fd2b0ac75c31c5d4408ce3649d317374e745229981d02b6d0a4a1a74b07ada625e0da64da4058bbc237269941d6823990c9de53fc76cef3a123b9af4
@@ -1,3 +1,7 @@
1
+ ## 3.1.6
2
+ - Fix #97 With "ISO8601" format and timezone interpolation, Joda complains at plugin startup
3
+ - Fix skipped DST test, caused by incorrect year guess logic, see comment in test spec/filters/date_spec.rb:540
4
+
1
5
  ## 3.1.5
2
6
  - Ignore cancelled events
3
7
 
@@ -49,7 +53,7 @@
49
53
  - use Event#tag, relax specs for Java Event, code cleanups
50
54
 
51
55
  ## 2.0.0
52
- - Plugins were updated to follow the new shutdown semantic, this mainly allows Logstash to instruct input plugins to terminate gracefully,
56
+ - Plugins were updated to follow the new shutdown semantic, this mainly allows Logstash to instruct input plugins to terminate gracefully,
53
57
  instead of using Thread.raise on the plugins' threads. Ref: https://github.com/elastic/logstash/pull/3895
54
58
  - Dependency on logstash-core update to 2.0
55
59
 
@@ -25,6 +25,7 @@ Contributors:
25
25
  * Richard Pijnenburg (electrical)
26
26
  * Suyog Rao (suyograo)
27
27
  * debadair
28
+ * Guy Boertje (guyboertje)
28
29
 
29
30
  Note: If you've sent us patches, bug reports, or otherwise contributed to
30
31
  Logstash, and you aren't on the list above and want to be, please let us know
data/Gemfile CHANGED
@@ -1,4 +1,11 @@
1
1
  source 'https://rubygems.org'
2
2
 
3
- # Specify your gem's dependencies in logstash-mass_effect.gemspec
4
3
  gemspec
4
+
5
+ logstash_path = ENV["LOGSTASH_PATH"] || "../../logstash"
6
+ use_logstash_source = ENV["LOGSTASH_SOURCE"] && ENV["LOGSTASH_SOURCE"].to_s == "1"
7
+
8
+ if Dir.exist?(logstash_path) && use_logstash_source
9
+ gem 'logstash-core', :path => "#{logstash_path}/logstash-core"
10
+ gem 'logstash-core-plugin-api', :path => "#{logstash_path}/logstash-core-plugin-api"
11
+ end
@@ -0,0 +1,215 @@
1
+ :plugin: date
2
+ :type: filter
3
+
4
+ ///////////////////////////////////////////
5
+ START - GENERATED VARIABLES, DO NOT EDIT!
6
+ ///////////////////////////////////////////
7
+ :version: %VERSION%
8
+ :release_date: %RELEASE_DATE%
9
+ :changelog_url: %CHANGELOG_URL%
10
+ :include_path: ../../../../logstash/docs/include
11
+ ///////////////////////////////////////////
12
+ END - GENERATED VARIABLES, DO NOT EDIT!
13
+ ///////////////////////////////////////////
14
+
15
+ [id="plugins-{type}-{plugin}"]
16
+
17
+ === Date filter plugin
18
+
19
+ include::{include_path}/plugin_header.asciidoc[]
20
+
21
+ ==== Description
22
+
23
+ The date filter is used for parsing dates from fields, and then using that
24
+ date or timestamp as the logstash timestamp for the event.
25
+
26
+ For example, syslog events usually have timestamps like this:
27
+ [source,ruby]
28
+ "Apr 17 09:32:01"
29
+
30
+ You would use the date format `MMM dd HH:mm:ss` to parse this.
31
+
32
+ The date filter is especially important for sorting events and for
33
+ backfilling old data. If you don't get the date correct in your
34
+ event, then searching for them later will likely sort out of order.
35
+
36
+ In the absence of this filter, logstash will choose a timestamp based on the
37
+ first time it sees the event (at input time), if the timestamp is not already
38
+ set in the event. For example, with file input, the timestamp is set to the
39
+ time of each read.
40
+
41
+ [id="plugins-{type}s-{plugin}-options"]
42
+ ==== Date Filter Configuration Options
43
+
44
+ This plugin supports the following configuration options plus the <<plugins-{type}s-{plugin}-common-options>> described later.
45
+
46
+ [cols="<,<,<",options="header",]
47
+ |=======================================================================
48
+ |Setting |Input type|Required
49
+ | <<plugins-{type}s-{plugin}-locale>> |<<string,string>>|No
50
+ | <<plugins-{type}s-{plugin}-match>> |<<array,array>>|No
51
+ | <<plugins-{type}s-{plugin}-tag_on_failure>> |<<array,array>>|No
52
+ | <<plugins-{type}s-{plugin}-target>> |<<string,string>>|No
53
+ | <<plugins-{type}s-{plugin}-timezone>> |<<string,string>>|No
54
+ |=======================================================================
55
+
56
+ Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
57
+ filter plugins.
58
+
59
+ &nbsp;
60
+
61
+ [id="plugins-{type}s-{plugin}-locale"]
62
+ ===== `locale`
63
+
64
+ * Value type is <<string,string>>
65
+ * There is no default value for this setting.
66
+
67
+ Specify a locale to be used for date parsing using either IETF-BCP47 or POSIX language tag.
68
+ Simple examples are `en`,`en-US` for BCP47 or `en_US` for POSIX.
69
+
70
+ The locale is mostly necessary to be set for parsing month names (pattern with `MMM`) and
71
+ weekday names (pattern with `EEE`).
72
+
73
+ If not specified, the platform default will be used but for non-english platform default
74
+ an english parser will also be used as a fallback mechanism.
75
+
76
+ [id="plugins-{type}s-{plugin}-match"]
77
+ ===== `match`
78
+
79
+ * Value type is <<array,array>>
80
+ * Default value is `[]`
81
+
82
+ An array with field name first, and format patterns following, `[ field,
83
+ formats... ]`
84
+
85
+ If your time field has multiple possible formats, you can do this:
86
+ [source,ruby]
87
+ match => [ "logdate", "MMM dd yyyy HH:mm:ss",
88
+ "MMM d yyyy HH:mm:ss", "ISO8601" ]
89
+
90
+ The above will match a syslog (rfc3164) or `iso8601` timestamp.
91
+
92
+ There are a few special exceptions. The following format literals exist
93
+ to help you save time and ensure correctness of date parsing.
94
+
95
+ * `ISO8601` - should parse any valid ISO8601 timestamp, such as
96
+ `2011-04-19T03:44:01.103Z`
97
+ * `UNIX` - will parse *float or int* value expressing unix time in seconds since epoch like 1326149001.132 as well as 1326149001
98
+ * `UNIX_MS` - will parse **int** value expressing unix time in milliseconds since epoch like 1366125117000
99
+ * `TAI64N` - will parse tai64n time values
100
+
101
+ For example, if you have a field `logdate`, with a value that looks like
102
+ `Aug 13 2010 00:03:44`, you would use this configuration:
103
+ [source,ruby]
104
+ filter {
105
+ date {
106
+ match => [ "logdate", "MMM dd yyyy HH:mm:ss" ]
107
+ }
108
+ }
109
+
110
+ If your field is nested in your structure, you can use the nested
111
+ syntax `[foo][bar]` to match its value. For more information, please refer to
112
+ <<logstash-config-field-references>>
113
+
114
+ *More details on the syntax*
115
+
116
+ The syntax used for parsing date and time text uses letters to indicate the
117
+ kind of time value (month, minute, etc), and a repetition of letters to
118
+ indicate the form of that value (2-digit month, full month name, etc).
119
+
120
+ Here's what you can use to parse dates and times:
121
+
122
+ [horizontal]
123
+ y:: year
124
+ yyyy::: full year number. Example: `2015`.
125
+ yy::: two-digit year. Example: `15` for the year 2015.
126
+
127
+ M:: month of the year
128
+ M::: minimal-digit month. Example: `1` for January and `12` for December.
129
+ MM::: two-digit month. zero-padded if needed. Example: `01` for January and `12` for December
130
+ MMM::: abbreviated month text. Example: `Jan` for January. Note: The language used depends on your locale. See the `locale` setting for how to change the language.
131
+ MMMM::: full month text, Example: `January`. Note: The language used depends on your locale.
132
+
133
+ d:: day of the month
134
+ d::: minimal-digit day. Example: `1` for the 1st of the month.
135
+ dd::: two-digit day, zero-padded if needed. Example: `01` for the 1st of the month.
136
+
137
+ H:: hour of the day (24-hour clock)
138
+ H::: minimal-digit hour. Example: `0` for midnight.
139
+ HH::: two-digit hour, zero-padded if needed. Example: `00` for midnight.
140
+
141
+ m:: minutes of the hour (60 minutes per hour)
142
+ m::: minimal-digit minutes. Example: `0`.
143
+ mm::: two-digit minutes, zero-padded if needed. Example: `00`.
144
+
145
+ s:: seconds of the minute (60 seconds per minute)
146
+ s::: minimal-digit seconds. Example: `0`.
147
+ ss::: two-digit seconds, zero-padded if needed. Example: `00`.
148
+
149
+ S:: fraction of a second
150
+ *Maximum precision is milliseconds (`SSS`). Beyond that, zeroes are appended.*
151
+ S::: tenths of a second. Example: `0` for a subsecond value `012`
152
+ SS::: hundredths of a second. Example: `01` for a subsecond value `01`
153
+ SSS::: thousandths of a second. Example: `012` for a subsecond value `012`
154
+
155
+ Z:: time zone offset or identity
156
+ Z::: Timezone offset structured as HHmm (hour and minutes offset from Zulu/UTC). Example: `-0700`.
157
+ ZZ::: Timezone offset structured as HH:mm (colon in between hour and minute offsets). Example: `-07:00`.
158
+ ZZZ::: Timezone identity. Example: `America/Los_Angeles`. Note: Valid IDs are listed on the http://joda-time.sourceforge.net/timezones.html[Joda.org available time zones page].
159
+
160
+ z:: time zone names. *Time zone names ('z') cannot be parsed.*
161
+
162
+ w:: week of the year
163
+ w::: minimal-digit week. Example: `1`.
164
+ ww::: two-digit week, zero-padded if needed. Example: `01`.
165
+
166
+ D:: day of the year
167
+
168
+ e:: day of the week (number)
169
+
170
+ E:: day of the week (text)
171
+ E, EE, EEE::: Abbreviated day of the week. Example: `Mon`, `Tue`, `Wed`, `Thu`, `Fri`, `Sat`, `Sun`. Note: The actual language of this will depend on your locale.
172
+ EEEE::: The full text day of the week. Example: `Monday`, `Tuesday`, ... Note: The actual language of this will depend on your locale.
173
+
174
+ For non-formatting syntax, you'll need to put single-quote characters around the value. For example, if you were parsing ISO8601 time, "2015-01-01T01:12:23" that little "T" isn't a valid time format, and you want to say "literally, a T", your format would be this: "yyyy-MM-dd'T'HH:mm:ss"
175
+
176
+ Other less common date units, such as era (G), century \(C), am/pm (a), and # more, can be learned about on the
177
+ http://www.joda.org/joda-time/key_format.html[joda-time documentation].
178
+
179
+ [id="plugins-{type}s-{plugin}-tag_on_failure"]
180
+ ===== `tag_on_failure`
181
+
182
+ * Value type is <<array,array>>
183
+ * Default value is `["_dateparsefailure"]`
184
+
185
+ Append values to the `tags` field when there has been no
186
+ successful match
187
+
188
+ [id="plugins-{type}s-{plugin}-target"]
189
+ ===== `target`
190
+
191
+ * Value type is <<string,string>>
192
+ * Default value is `"@timestamp"`
193
+
194
+ Store the matching timestamp into the given target field. If not provided,
195
+ default to updating the `@timestamp` field of the event.
196
+
197
+ [id="plugins-{type}s-{plugin}-timezone"]
198
+ ===== `timezone`
199
+
200
+ * Value type is <<string,string>>
201
+ * There is no default value for this setting.
202
+
203
+ Specify a time zone canonical ID to be used for date parsing.
204
+ The valid IDs are listed on the http://joda-time.sourceforge.net/timezones.html[Joda.org available time zones page].
205
+ This is useful in case the time zone cannot be extracted from the value,
206
+ and is not the platform default.
207
+ If this is not specified the platform default will be used.
208
+ Canonical ID is good as it takes care of daylight saving time for you
209
+ For example, `America/Los_Angeles` or `Europe/Paris` are valid IDs.
210
+ This field can be dynamic and include parts of the event using the `%{field}` syntax
211
+
212
+
213
+
214
+ [id="plugins-{type}s-{plugin}-common-options"]
215
+ include::{include_path}/{type}.asciidoc[]
@@ -1,4 +1,4 @@
1
1
  # AUTOGENERATED BY THE GRADLE SCRIPT. DO NOT EDIT.
2
2
 
3
3
  require 'jar_dependencies'
4
- require_jar('org.logstash.filters', 'logstash-filter-date', '3.1.0')
4
+ require_jar('org.logstash.filters', 'logstash-filter-date', '3.1.6')
@@ -1,7 +1,7 @@
1
1
  Gem::Specification.new do |s|
2
2
 
3
3
  s.name = 'logstash-filter-date'
4
- s.version = '3.1.5'
4
+ s.version = '3.1.7'
5
5
  s.licenses = ['Apache License (2.0)']
6
6
  s.summary = "The date filter is used for parsing dates from fields, and then using that date or timestamp as the logstash timestamp for the event."
7
7
  s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
@@ -11,7 +11,7 @@ Gem::Specification.new do |s|
11
11
  s.require_paths = ["lib", "vendor/jar-dependencies"]
12
12
 
13
13
  # Files
14
- s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT', "vendor/jar-dependencies/**/*.jar"]
14
+ s.files = Dir["lib/**/*","spec/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "vendor/jar-dependencies/**/*.jar", "vendor/jar-dependencies/**/*.rb", "VERSION", "docs/**/*"]
15
15
 
16
16
  # Tests
17
17
  s.test_files = s.files.grep(%r{^(test|spec|features)/})
@@ -127,7 +127,7 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
127
127
  #Invalid value should not be evaluated to zero (String#to_i madness)
128
128
  sample("mydate" => "%{bad_value}") do
129
129
  insist { subject.get("mydate") } == "%{bad_value}"
130
- insist { subject.get("@timestamp") } != Time.iso8601("1970-01-01T00:00:00.000Z").utc
130
+ insist { subject.get("@timestamp").time } != Time.iso8601("1970-01-01T00:00:00.000Z").utc
131
131
  end
132
132
  end
133
133
 
@@ -155,15 +155,16 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
155
155
  #Invalid value should not be evaluated to zero (String#to_i madness)
156
156
  sample("mydate" => "%{bad_value}") do
157
157
  insist { subject.get("mydate") } == "%{bad_value}"
158
- insist { subject.get("@timestamp") } != Time.iso8601("1970-01-01T00:00:00.000Z").utc
158
+ insist { subject.get("@timestamp").time } != Time.iso8601("1970-01-01T00:00:00.000Z").utc
159
159
  end
160
160
 
161
161
  # Regression test
162
- # Support numeric values that come through the JSON parser. These numbers appear as BigDecimal
162
+ # Support numeric values that come through the JSON parser. These numbers appear as BigDecimal
163
163
  # instead of Float.
164
164
  sample(LogStash::Json.load('{ "mydate": 1350414944.123456 }')) do
165
- insist { subject.get("mydate") } == 1350414944.123456
166
- p subject.to_hash
165
+ # its generally problematic to compare different Floating Point class implementations using equals
166
+ # because they can't always represent a value exactly.
167
+ insist { subject.get("mydate") } == BigDecimal.new("1350414944.123456")
167
168
  insist { subject.get("@timestamp").time } == Time.iso8601("2012-10-16T12:15:44.123-07:00").utc
168
169
  end
169
170
  end
@@ -191,7 +192,7 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
191
192
  times.each do |input, output|
192
193
  sample("mydate" => input) do
193
194
  insist { subject.get("mydate") } == input
194
- insist { subject.get("@timestamp").time } == Time.iso8601(output)
195
+ insist { subject.get("@timestamp").time } == Time.iso8601(output).utc
195
196
  end
196
197
  end # times.each
197
198
  end
@@ -223,7 +224,7 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
223
224
  times.each do |input, output|
224
225
  sample("mydate" => input) do
225
226
  insist { subject.get("mydate") } == input
226
- insist { subject.get("@timestamp").time } == Time.iso8601(output)
227
+ insist { subject.get("@timestamp").time } == Time.iso8601(output).utc
227
228
  end
228
229
  end # times.each
229
230
  end
@@ -323,7 +324,8 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
323
324
  CONFIG
324
325
 
325
326
  sample("thedate" => "2013/Apr/21") do
326
- insist { subject.get("@timestamp") } != "2013-04-21T00:00:00.000Z"
327
+ expected = Time.iso8601("2013-04-21T00:00:00.000Z").utc
328
+ expect(subject.get("@timestamp").time).not_to eq(expected)
327
329
  end
328
330
  end
329
331
 
@@ -333,12 +335,14 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
333
335
  date {
334
336
  match => [ "thedate", "yyyy/MM/dd" ]
335
337
  add_tag => "tagged"
338
+ timezone => "UTC"
336
339
  }
337
340
  }
338
341
  CONFIG
339
342
 
340
343
  sample("thedate" => "2013/04/21") do
341
- insist { subject.get("@timestamp") } != "2013-04-21T00:00:00.000Z"
344
+ expected = Time.iso8601("2013-04-21T00:00:00.000Z").utc
345
+ expect(subject.get("@timestamp").time).to eq(expected)
342
346
  insist { subject.get("tags") } == ["tagged"]
343
347
  end
344
348
  end
@@ -349,12 +353,14 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
349
353
  date {
350
354
  match => [ "thedate", "yyyy/MM/dd" ]
351
355
  add_tag => "tagged"
356
+ timezone => "UTC"
352
357
  }
353
358
  }
354
359
  CONFIG
355
360
 
356
361
  sample("thedate" => "2013/Apr/21") do
357
- insist { subject.get("@timestamp") } != "2013-04-21T00:00:00.000Z"
362
+ expected = Time.iso8601("2013-04-21T00:00:00.000Z").utc
363
+ expect(subject.get("@timestamp").time).not_to eq(expected)
358
364
  reject { subject.get("tags") }.include? "tagged"
359
365
  end
360
366
  end
@@ -365,12 +371,14 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
365
371
  date {
366
372
  match => [ "thedate", "yyyy/MM/dd" ]
367
373
  tag_on_failure => ["date_failed"]
374
+ timezone => "UTC"
368
375
  }
369
376
  }
370
377
  CONFIG
371
378
 
372
379
  sample("thedate" => "2013/Apr/21") do
373
- insist { subject.get("@timestamp") } != "2013-04-21T00:00:00.000Z"
380
+ expected = Time.iso8601("2013-04-21T00:00:00.000Z").utc
381
+ expect(subject.get("@timestamp").time).not_to eq(expected)
374
382
  insist { subject.get("tags") }.include? "date_failed"
375
383
  end
376
384
  end
@@ -423,6 +431,37 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
423
431
  end # times.each
424
432
  end
425
433
 
434
+ describe "parsing IS08601 with timezone from event" do
435
+ config <<-CONFIG
436
+ filter {
437
+ date {
438
+ match => ["mydate", "ISO8601"]
439
+ locale => "en"
440
+ timezone => "%{mytz}"
441
+ }
442
+ }
443
+ CONFIG
444
+
445
+ require 'java'
446
+
447
+ # TIL Venezuela changed from -4:00 to -4:30 at 03:00 on Sun, 9 Dec 2007
448
+ sample("mydate" => "2007-12-09T01:00:00", "mytz" => "America/Caracas") do
449
+ expect(subject.get("mydate")).to eq("2007-12-09T01:00:00")
450
+ expect(subject.get("@timestamp").time).to eq(Time.iso8601("2007-12-09T05:00:00.000Z").utc)
451
+ end
452
+ sample("mydate" => "2007-12-09T10:00:00", "mytz" => "America/Caracas") do
453
+ expect(subject.get("mydate")).to eq("2007-12-09T10:00:00")
454
+ expect(subject.get("@timestamp").time).to eq(Time.iso8601("2007-12-09T14:30:00.000Z").utc)
455
+ end
456
+ # TIL Venezuela changed from -4:30 to -4:00 at 02:30 on Sunday, 1 May 2016
457
+ # but the bundled version of Joda (2.8.2) in JRuby 1.7.25 and 9.1.9.0 does not know about this.
458
+ # meaning that the @timestamp should be "2016-05-01T12:18:18.123Z".
459
+ sample("mydate" => "2016-05-01T08:18:18.123", "mytz" => "America/Caracas") do
460
+ expect(subject.get("mydate")).to eq("2016-05-01T08:18:18.123")
461
+ expect(subject.get("@timestamp").time).to eq(Time.iso8601("2016-05-01T12:48:18.123Z").utc)
462
+ end
463
+ end
464
+
426
465
  describe "don't fail on next years DST switchover in CET" do
427
466
  config <<-CONFIG
428
467
  filter {
@@ -440,7 +479,6 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
440
479
  end
441
480
 
442
481
  sample "2016 Mar 26 02:00:37" do
443
- p :subject => subject
444
482
  insist { subject.get("tags") } != ["_dateparsefailure"]
445
483
  insist { subject.get("@timestamp").to_s } == "2016-03-26T01:00:37.000Z"
446
484
  end
@@ -508,7 +546,14 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
508
546
  end
509
547
  end
510
548
 
511
- describe "don't fail on next years DST switchover in CET", :skip => "This test tries to parse a time that doesn't exist. '02:00:37' is a time that doesn't exist because this DST switch goes from 01:59:59 to 03:00:00, skipping 2am entirely. I don't know how this spec ever passed..." do
549
+ describe "do fail on 2016 DST switchover in CET" do
550
+ # This test tries to parse a time that doesn't exist. '02:00:01' is a time that doesn't exist
551
+ # because this DST switch goes from 01:59:59 to 03:00:00, skipping 2am entirely. The last Sunday of March in 2016 was 27th.
552
+ # (Guy Boertje) Fixed the GuessYear logic
553
+ # Joda has a default year for DateTimeFormat of 2000
554
+ # meaning that the initial time parsed was Monday 2000-03-27 02:00:01 and the last Sunday of March in 2000 was the 26th
555
+ # then by adding the year of 2016 creates an invalid time
556
+ # The parser default now takes the year from the DefaultClock in the JodaParser
512
557
  config <<-CONFIG
513
558
  filter {
514
559
  date {
@@ -525,9 +570,18 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
525
570
  org.logstash.filters.parser.JodaParser.setDefaultClock { org.joda.time.DateTime.new(2016,03,29,23,59,50, org.joda.time.DateTimeZone::UTC ) }
526
571
  end
527
572
 
528
- sample "Mar 26 02:00:37" do
529
- insist { subject.get("tags") } != ["_dateparsefailure"]
530
- insist { subject.get("@timestamp").to_s } == "2016-03-26T01:00:37.000Z"
573
+ sample "Mar 27 01:59:59" do
574
+ expect(subject.get("tags")).to be_nil
575
+ expect(subject.get("@timestamp").to_s).to eq "2016-03-27T00:59:59.000Z"
576
+ end
577
+
578
+ sample "Mar 27 02:00:01" do
579
+ expect(subject.get("tags")).to eq ["_dateparsefailure"]
580
+ end
581
+
582
+ sample "Mar 27 03:00:01" do
583
+ expect(subject.get("tags")).to be_nil
584
+ expect(subject.get("@timestamp").to_s).to eq "2016-03-27T01:00:01.000Z"
531
585
  end
532
586
  end
533
587
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: logstash-filter-date
3
3
  version: !ruby/object:Gem::Version
4
- version: 3.1.5
4
+ version: 3.1.7
5
5
  platform: ruby
6
6
  authors:
7
7
  - Elastic
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2017-04-26 00:00:00.000000000 Z
11
+ date: 2017-06-23 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  requirement: !ruby/object:Gem::Requirement
@@ -112,12 +112,13 @@ files:
112
112
  - LICENSE
113
113
  - NOTICE.TXT
114
114
  - README.md
115
+ - docs/index.asciidoc
115
116
  - lib/logstash-filter-date_jars.rb
116
117
  - lib/logstash/filters/date.rb
117
118
  - logstash-filter-date.gemspec
118
119
  - spec/filters/date_spec.rb
119
120
  - spec/fixtures/old_date_filter.rb
120
- - vendor/jar-dependencies/org/logstash/filters/logstash-filter-date/3.1.0/logstash-filter-date-3.1.0.jar
121
+ - vendor/jar-dependencies/org/logstash/filters/logstash-filter-date/3.1.6/logstash-filter-date-3.1.6.jar
121
122
  homepage: http://www.elastic.co/guide/en/logstash/current/index.html
122
123
  licenses:
123
124
  - Apache License (2.0)