logstash-filter-dynamo_enrich 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 32bc4f215634abd8e6c5e9477e7c88903a90ba67
+  data.tar.gz: 4f022b96d8bf2eee5ea1757799c3f138e65c2636
+SHA512:
+  metadata.gz: aafaf79d593c53172ee62567458b4529068a498242a982a0714711e08433440ef010415708985a0a8921c4d85d8ae1bf7d0a3ca6862b1babc66f62acca0e4f2b
+  data.tar.gz: 0302ba0ad9e0eaba99cff35878524b93082caacc3bf9026af0bbc5cbe79afeaca1bffe67953e43334944f24fe1c212606ee183dbc2212c6a3946678db22b1c14

data/CHANGELOG.md

@@ -0,0 +1,2 @@
+## 0.1.0
+  - Plugin created with the logstash plugin generator

data/CONTRIBUTORS

@@ -0,0 +1,10 @@
+The following is a list of people who have contributed ideas, code, bug
+reports, or in general have helped logstash along its way.
+
+Contributors:
+* your_username - your_username@example.com
+
+Note: If you've sent us patches, bug reports, or otherwise contributed to
+Logstash, and you aren't on the list above and want to be, please let us know
+and we'll make sure you're here. Contributions from folks like you are what make
+open source awesome.

data/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+gemspec
+

data/LICENSE

@@ -0,0 +1,11 @@
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

data/README.md

@@ -0,0 +1,83 @@
+# Logstash Plugin
+
+This is a plugin for [Logstash](https://github.com/elastic/logstash).
+
+It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.
+
+## Documentation
+
+See [Docs](./docs)
+
+## Need Help?
+
+Need help? Try #logstash on freenode IRC or the https://discuss.elastic.co/c/logstash discussion forum.
+
+## Developing
+
+### 1. Plugin Developement and Testing
+
+#### Code
+- To get started, you'll need JRuby with the Bundler gem installed.
+
+- Create a new plugin or clone and existing from the GitHub [logstash-plugins](https://github.com/logstash-plugins) organization. We also provide [example plugins](https://github.com/logstash-plugins?query=example).
+
+- Install dependencies
+```sh
+bundle install
+```
+
+#### Test
+
+- Update your dependencies
+
+```sh
+bundle install
+```
+
+- Run tests
+
+```sh
+bundle exec rspec
+```
+
+### 2. Running your unpublished Plugin in Logstash
+
+#### 2.1 Run in a local Logstash clone
+
+- Edit Logstash `Gemfile` and add the local plugin path, for example:
+```ruby
+gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
+```
+- Install plugin
+```sh
+bin/logstash-plugin install --no-verify
+```
+- Run Logstash with your plugin
+```sh
+bin/logstash -e 'filter {awesome {}}'
+```
+At this point any modifications to the plugin code will be applied to this local Logstash setup. After modifying the plugin, simply rerun Logstash.
+
+#### 2.2 Run in an installed Logstash
+
+You can use the same **2.1** method to run your plugin in an installed Logstash by editing its `Gemfile` and pointing the `:path` to your local plugin development directory or you can build the gem and install it using:
+
+- Build your plugin gem
+```sh
+gem build logstash-filter-awesome.gemspec
+```
+- Install the plugin from the Logstash home
+```sh
+bin/logstash-plugin install /your/local/plugin/logstash-filter-awesome.gem
+```
+- Start Logstash and proceed to test the plugin
+
+## Contributing
+
+All contributions are welcome: ideas, patches, documentation, bug reports, complaints, and even something you drew up on a napkin.
+
+Programming is not a required skill. Whatever you've seen about open source and maintainers or community members  saying "send patches or die" - you will not see that here.
+
+It is more important to the community that you are able to contribute.
+
+For more information about contributing, see the [CONTRIBUTING](https://github.com/elastic/logstash/blob/master/CONTRIBUTING.md) file.

data/lib/logstash/filters/dynamo_enrich.rb

@@ -0,0 +1,77 @@
+# encoding: utf-8
+require "logstash/filters/base"
+require "logstash/namespace"
+require "lru_redux"
+
+# Workaround to JRuby 1.7 bug that will never be fixed https://github.com/jruby/jruby/issues/3920
+module Aws; module DynamoDB; end; end
+require 'aws-sdk'
+require 'aws-sdk-core/dynamodb'
+
+class LogStash::Filters::DynamoEnrich < LogStash::Filters::Base
+  config_name "dynamo_enrich"
+
+  config :table_name, :validate => :string, :required => true
+  config :region, :validate => :string, :default => ""
+  config :primary_key_name, :validate => :string, :required => true
+  config :primary_key_value, :validate => :string, :required => true
+  config :return_attribute, :validate => :string, :required => true
+  config :target, :validate => :string, :required => true
+  config :enable_cache, :validate => :boolean, :default => true
+  config :cache_ttl, :validate => :number, :default => 300
+  config :cache_size, :validate => :number, :default => 1024
+
+  public
+  def register
+    region_set = @region != ""
+    if region_set
+      @client = Aws::DynamoDB::Client.new(region: @region)
+    else
+      @client = Aws::DynamoDB::Client.new()
+    end
+
+    if @enable_cache
+      @cache = LruRedux::TTL::ThreadSafeCache.new(@cache_size, @cache_ttl)
+    end
+  end # def register
+
+  public
+  def filter(event)
+    primary_key_value = event.get(@primary_key_value)
+    if @enable_cache && @cache.key?(primary_key_value)
+      cached_value = @cache[primary_key_value]
+      if cached_value
+        event.set(@target, ::LogStash::Util.deep_clone(cached_value))
+      else
+        event.tag("_dynamoenrichitemnotfound")
+      end
+    else
+      lookup_value = fetch_dynamo(primary_key_value)
+      @cache.getset(primary_key_value){lookup_value} if @enable_cache
+
+      if lookup_value
+        event.set(@target, ::LogStash::Util.deep_clone(lookup_value))
+      else
+        event.tag("_dynamoenrichitemnotfound")
+      end
+    end
+    filter_matched(event)
+  rescue Aws::DynamoDB::Errors::ServiceError => e
+    @logger.warn("DynamoDB Service Exception", :exception => e, :event => event)
+    event.tag("_dynamoenrichserviceerror")
+  end # def filter
+
+  def fetch_dynamo(primary_key_value)
+    resp = @client.get_item({
+      key: {
+        @primary_key_name => primary_key_value,
+      }, 
+      table_name: @table_name, 
+    })
+
+    if resp.item && !resp.item.empty?
+      return resp.item[@return_attribute]
+    end
+    # return false
+  end
+end # class LogStash::Filters::DynamoEnrich

data/logstash-filter-dynamo_enrich.gemspec

@@ -0,0 +1,25 @@
+Gem::Specification.new do |s|
+  s.name          = 'logstash-filter-dynamo_enrich'
+  s.version       = '0.1.0'
+  s.licenses      = ['Apache License (2.0)']
+  s.summary       = 'Enrich Logstash events with data from DynamoDB'
+  s.description   = 'Query data from DynamoDB and populate Logstash events with the returned values'
+  s.homepage      = 'https://github.com/envato/logstash-filter-dynamo_enrich'
+  s.authors       = ['nemski']
+  s.email         = 'patrick.robinson@envato.com'
+  s.require_paths = ['lib']
+
+  # Files
+  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
+   # Tests
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
+  s.add_runtime_dependency "aws-sdk", "~> 2.3"
+  s.add_runtime_dependency "lru_redux", "~> 1.0"
+  s.add_development_dependency 'logstash-devutils'
+end

data/spec/filters/dynamo_enrich_spec.rb

@@ -0,0 +1,122 @@
+# encoding: utf-8
+require_relative '../spec_helper'
+require "logstash/filters/dynamo_enrich"
+
+describe LogStash::Filters::DynamoEnrich do
+  describe "Lookup Table" do
+    let(:config) do <<-CONFIG
+      filter {
+        dynamo_enrich {
+          table_name => "id_lookup"
+          region => "us-east-1"
+          primary_key_name => "id"
+          primary_key_value => "user_id"
+          return_attribute => "name"
+          target => "user_name"
+          enable_cache => false
+        }
+      }
+    CONFIG
+    end
+    let(:dynamo_client) { instance_double(Aws::DynamoDB::Client) }
+    let(:dynamo_response) { instance_double(Aws::DynamoDB::Types::GetItemOutput) }
+  
+    before do
+      allow(Aws::DynamoDB::Client).to receive(:new).and_return(dynamo_client)
+      allow(dynamo_response).to receive(:item).and_return(item)
+    end
+
+    context "Item exists" do
+      let(:item) { {"name" => "Jane Doe"} }
+
+      before do
+        allow(dynamo_client).to receive(:get_item).and_return(dynamo_response)
+      end
+
+      sample("user_id" => "123") do
+        expect(subject).to include("user_name")
+        expect(subject.get('user_name')).to eq('Jane Doe')
+      end
+    end
+
+    context "Item doesn't exist" do
+      let(:item) { {} }
+
+      before do
+        allow(dynamo_client).to receive(:get_item).and_return(dynamo_response)
+      end
+
+      sample("user_id" => "123") do
+        expect(subject.get('tags')).to include('_dynamoenrichitemnotfound')
+      end
+    end
+
+    context "Dynamo returns a service error" do
+      let(:item) { {} }
+
+      before do
+        expect(dynamo_client).to receive(:get_item).and_raise(Aws::DynamoDB::Errors::ServiceError.new(Seahorse::Client::RequestContext.new, "Internal Error"))
+      end
+
+      sample("user_id" => "123") do
+        expect(subject.get('tags')).to include('_dynamoenrichserviceerror')
+      end
+    end
+  end
+
+  describe "Cached result" do
+    let(:config) do <<-CONFIG
+      filter {
+        dynamo_enrich {
+          table_name => "id_lookup"
+          region => "us-east-1"
+          primary_key_name => "id"
+          primary_key_value => "user_id"
+          return_attribute => "name"
+          target => "user_name"
+        }
+      }
+    CONFIG
+    end
+    let(:dynamo_client) { instance_double(Aws::DynamoDB::Client) }
+    let(:dynamo_response) { instance_double(Aws::DynamoDB::Types::GetItemOutput) }
+    let(:cache_double) { instance_double(LruRedux::TTL::ThreadSafeCache) }
+  
+    before do
+      allow(Aws::DynamoDB::Client).to receive(:new).and_return(dynamo_client)
+      allow(LruRedux::TTL::ThreadSafeCache).to receive(:new).and_return(cache_double)
+    end
+
+    context "Item is cached" do
+      before do
+        allow(cache_double).to receive(:key?).with("123").and_return(true)
+        allow(cache_double).to receive(:[]).with("123").and_return("Jane Doe")
+      end
+
+      sample("user_id" => "123") do
+        expect(dynamo_client).not_to receive(:get_item)
+        expect(subject).to include("user_name")
+        expect(subject.get('user_name')).to eq('Jane Doe')
+      end
+    end
+
+    context "Item is not cached" do
+      let(:item) { {} }
+    
+      before do
+        allow(cache_double).to receive(:key?).with("123").and_return(false)
+        allow(cache_double).to receive(:getset)
+        allow(dynamo_response).to receive(:item).and_return(item)
+        allow(dynamo_client).to receive(:get_item).and_return(dynamo_response)
+      end
+
+      sample("user_id" => "123") do
+        expect(cache_double).not_to receive(:[])
+        expect(dynamo_client).to receive(:get_item)
+
+        subject
+      end
+    end
+  end
+
+end

data/spec/spec_helper.rb

@@ -0,0 +1,2 @@
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"

metadata

@@ -0,0 +1,112 @@
+--- !ruby/object:Gem::Specification
+name: logstash-filter-dynamo_enrich
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- nemski
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2017-12-19 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  name: logstash-core-plugin-api
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
+  name: aws-sdk
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  name: lru_redux
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  name: logstash-devutils
+  prerelease: false
+  type: :development
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Query data from DynamoDB and populate Logstash events with the returned values
+email: patrick.robinson@envato.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- CONTRIBUTORS
+- Gemfile
+- LICENSE
+- README.md
+- lib/logstash/filters/dynamo_enrich.rb
+- logstash-filter-dynamo_enrich.gemspec
+- spec/filters/dynamo_enrich_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/envato/logstash-filter-dynamo_enrich
+licenses:
+- Apache License (2.0)
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: filter
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project:
+rubygems_version: 2.4.8
+signing_key:
+specification_version: 4
+summary: Enrich Logstash events with data from DynamoDB
+test_files:
+- spec/filters/dynamo_enrich_spec.rb
+- spec/spec_helper.rb