logstash-filter-elapsed 3.0.2 → 4.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +5 -0
- data/LICENSE +1 -1
- data/README.md +12 -3
- data/lib/logstash/filters/elapsed.rb +17 -17
- data/logstash-filter-elapsed.gemspec +3 -3
- data/spec/filters/elapsed_spec.rb +21 -21
- metadata +13 -7
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 6892219b404e96411216707b1bb17cf60884dd65
|
4
|
+
data.tar.gz: d61cb14d8de18190aff53baebc8acb993a322cfc
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 5a9d450ea54de03a47264f6f7703b28456166a12060a1709c1f15132df076840b346ae169fb76e0377f5649e6f58317524edeef750052b6f3da1a359981de9a8
|
7
|
+
data.tar.gz: fec56248a3ce501791129f5565ba3e338f5140423cecb62d25a24e17b5c020bd725ba00f7ac3d6158dadadc01e02f7a0d3a7e7160c416eae45e8972511af12f4
|
data/CHANGELOG.md
CHANGED
@@ -1,7 +1,12 @@
|
|
1
|
+
# 4.0.0
|
2
|
+
- Use the new Event Api used in v5.0.0+
|
3
|
+
|
1
4
|
# 3.0.2
|
2
5
|
- Depend on logstash-core-plugin-api instead of logstash-core, removing the need to mass update plugins on major releases of logstash
|
6
|
+
|
3
7
|
# 3.0.1
|
4
8
|
- New dependency requirements for logstash-core for the 5.0 release
|
9
|
+
|
5
10
|
## 3.0.0
|
6
11
|
- Elasticsearch 2.0 does not allow field names with dots in them. This is a
|
7
12
|
breaking change which replaces the `.` with an underscore, `_`
|
data/LICENSE
CHANGED
data/README.md
CHANGED
@@ -1,7 +1,6 @@
|
|
1
1
|
# Logstash Plugin
|
2
2
|
|
3
|
-
[](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Filters/job/logstash-plugin-filter-elapsed-unit/)
|
3
|
+
[](https://travis-ci.org/logstash-plugins/logstash-filter-elapsed)
|
5
4
|
|
6
5
|
This is a plugin for [Logstash](https://github.com/elastic/logstash).
|
7
6
|
|
@@ -56,7 +55,12 @@ gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
|
|
56
55
|
```
|
57
56
|
- Install plugin
|
58
57
|
```sh
|
58
|
+
# Logstash 2.3 and higher
|
59
|
+
bin/logstash-plugin install --no-verify
|
60
|
+
|
61
|
+
# Prior to Logstash 2.3
|
59
62
|
bin/plugin install --no-verify
|
63
|
+
|
60
64
|
```
|
61
65
|
- Run Logstash with your plugin
|
62
66
|
```sh
|
@@ -74,7 +78,12 @@ gem build logstash-filter-awesome.gemspec
|
|
74
78
|
```
|
75
79
|
- Install the plugin from the Logstash home
|
76
80
|
```sh
|
77
|
-
|
81
|
+
# Logstash 2.3 and higher
|
82
|
+
bin/logstash-plugin install --no-verify
|
83
|
+
|
84
|
+
# Prior to Logstash 2.3
|
85
|
+
bin/plugin install --no-verify
|
86
|
+
|
78
87
|
```
|
79
88
|
- Start Logstash and proceed to test the plugin
|
80
89
|
|
@@ -39,13 +39,13 @@ require 'socket'
|
|
39
39
|
# [source,ruby]
|
40
40
|
# filter {
|
41
41
|
# grok {
|
42
|
-
# match =>
|
42
|
+
# match => { "message" => "%{TIMESTAMP_ISO8601} START id: (?<task_id>.*)" }
|
43
43
|
# add_tag => [ "taskStarted" ]
|
44
44
|
# }
|
45
45
|
#
|
46
46
|
# grok {
|
47
|
-
# match =>
|
48
|
-
# add_tag => [ "taskTerminated"]
|
47
|
+
# match => { "message" => "%{TIMESTAMP_ISO8601} END id: (?<task_id>.*)" }
|
48
|
+
# add_tag => [ "taskTerminated" ]
|
49
49
|
# }
|
50
50
|
#
|
51
51
|
# elapsed {
|
@@ -133,7 +133,7 @@ class LogStash::Filters::Elapsed < LogStash::Filters::Base
|
|
133
133
|
def filter(event)
|
134
134
|
|
135
135
|
|
136
|
-
unique_id = event
|
136
|
+
unique_id = event.get(@unique_id_field)
|
137
137
|
return if unique_id.nil?
|
138
138
|
|
139
139
|
if(start_event?(event))
|
@@ -154,13 +154,13 @@ class LogStash::Filters::Elapsed < LogStash::Filters::Base
|
|
154
154
|
if(@start_events.has_key?(unique_id))
|
155
155
|
start_event = @start_events.delete(unique_id).event
|
156
156
|
@mutex.unlock
|
157
|
-
elapsed = event
|
157
|
+
elapsed = event.get("@timestamp") - start_event.get("@timestamp")
|
158
158
|
if(@new_event_on_match)
|
159
|
-
elapsed_event = new_elapsed_event(elapsed, unique_id, start_event
|
159
|
+
elapsed_event = new_elapsed_event(elapsed, unique_id, start_event.get("@timestamp"))
|
160
160
|
filter_matched(elapsed_event)
|
161
161
|
yield elapsed_event if block_given?
|
162
162
|
else
|
163
|
-
return add_elapsed_info(event, elapsed, unique_id, start_event
|
163
|
+
return add_elapsed_info(event, elapsed, unique_id, start_event.get("@timestamp"))
|
164
164
|
end
|
165
165
|
else
|
166
166
|
@mutex.unlock
|
@@ -211,10 +211,10 @@ class LogStash::Filters::Elapsed < LogStash::Filters::Base
|
|
211
211
|
error_event.tag(ELAPSED_TAG)
|
212
212
|
error_event.tag(EXPIRED_ERROR_TAG)
|
213
213
|
|
214
|
-
error_event
|
215
|
-
error_event
|
216
|
-
error_event
|
217
|
-
error_event
|
214
|
+
error_event.set(HOST_FIELD, Socket.gethostname)
|
215
|
+
error_event.set(@unique_id_field, element.event.get(@unique_id_field) )
|
216
|
+
error_event.set(ELAPSED_FIELD, element.age)
|
217
|
+
error_event.set(TIMESTAMP_START_EVENT_FIELD, element.event.get("@timestamp") )
|
218
218
|
|
219
219
|
events << error_event
|
220
220
|
filter_matched(error_event)
|
@@ -224,16 +224,16 @@ class LogStash::Filters::Elapsed < LogStash::Filters::Base
|
|
224
224
|
end
|
225
225
|
|
226
226
|
def start_event?(event)
|
227
|
-
return (event
|
227
|
+
return (event.get("tags") != nil && event.get("tags").include?(@start_tag))
|
228
228
|
end
|
229
229
|
|
230
230
|
def end_event?(event)
|
231
|
-
return (event
|
231
|
+
return (event.get("tags") != nil && event.get("tags").include?(@end_tag))
|
232
232
|
end
|
233
233
|
|
234
234
|
def new_elapsed_event(elapsed_time, unique_id, timestamp_start_event)
|
235
235
|
new_event = LogStash::Event.new
|
236
|
-
new_event
|
236
|
+
new_event.set(HOST_FIELD, Socket.gethostname)
|
237
237
|
return add_elapsed_info(new_event, elapsed_time, unique_id, timestamp_start_event)
|
238
238
|
end
|
239
239
|
|
@@ -241,9 +241,9 @@ class LogStash::Filters::Elapsed < LogStash::Filters::Base
|
|
241
241
|
event.tag(ELAPSED_TAG)
|
242
242
|
event.tag(MATCH_TAG)
|
243
243
|
|
244
|
-
event
|
245
|
-
event
|
246
|
-
event
|
244
|
+
event.set(ELAPSED_FIELD, elapsed_time)
|
245
|
+
event.set(@unique_id_field, unique_id)
|
246
|
+
event.set(TIMESTAMP_START_EVENT_FIELD, timestamp_start_event)
|
247
247
|
|
248
248
|
return event
|
249
249
|
end
|
@@ -1,10 +1,10 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-elapsed'
|
4
|
-
s.version = '
|
4
|
+
s.version = '4.0.0'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "This filter tracks a pair of start/end events and calculates the elapsed time between them."
|
7
|
-
s.description = "This gem is a
|
7
|
+
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
8
8
|
s.authors = ["Elastic"]
|
9
9
|
s.email = 'info@elastic.co'
|
10
10
|
s.homepage = "http://www.elastic.co/guide/en/logstash/current/index.html"
|
@@ -20,7 +20,7 @@ Gem::Specification.new do |s|
|
|
20
20
|
s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
|
21
21
|
|
22
22
|
# Gem dependencies
|
23
|
-
s.add_runtime_dependency "logstash-core-plugin-api", "
|
23
|
+
s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
|
24
24
|
|
25
25
|
s.add_development_dependency 'logstash-devutils'
|
26
26
|
end
|
@@ -105,7 +105,7 @@ describe LogStash::Filters::Elapsed do
|
|
105
105
|
|
106
106
|
@filter.filter(end_event)
|
107
107
|
|
108
|
-
insist { end_event
|
108
|
+
insist { end_event.get("tags").include?("elapsed_end_without_start") } == true
|
109
109
|
end
|
110
110
|
end
|
111
111
|
end
|
@@ -150,23 +150,23 @@ describe LogStash::Filters::Elapsed do
|
|
150
150
|
|
151
151
|
shared_examples_for "match event" do
|
152
152
|
it "contains the tag 'elapsed'" do
|
153
|
-
insist { @match_event
|
153
|
+
insist { @match_event.get("tags").include?("elapsed") } == true
|
154
154
|
end
|
155
155
|
|
156
156
|
it "contains the tag tag 'elapsed_match'" do
|
157
|
-
insist { @match_event
|
157
|
+
insist { @match_event.get("tags").include?("elapsed_match") } == true
|
158
158
|
end
|
159
159
|
|
160
160
|
it "contains an 'elapsed_time field' with the elapsed time" do
|
161
|
-
insist { @match_event
|
161
|
+
insist { @match_event.get("elapsed_time") } == 10
|
162
162
|
end
|
163
163
|
|
164
164
|
it "contains an 'elapsed_timestamp_start field' with the timestamp of the 'start event'" do
|
165
|
-
insist { @match_event
|
165
|
+
insist { @match_event.get("elapsed_timestamp_start") } == @start_event.get("@timestamp")
|
166
166
|
end
|
167
167
|
|
168
168
|
it "contains an 'id field'" do
|
169
|
-
insist { @match_event
|
169
|
+
insist { @match_event.get(ID_FIELD) } == @id_value
|
170
170
|
end
|
171
171
|
end
|
172
172
|
|
@@ -178,7 +178,7 @@ describe LogStash::Filters::Elapsed do
|
|
178
178
|
@start_event = start_event(ID_FIELD => @id_value)
|
179
179
|
@filter.filter(@start_event)
|
180
180
|
|
181
|
-
end_timestamp = @start_event
|
181
|
+
end_timestamp = @start_event.get("@timestamp") + 10
|
182
182
|
end_event = end_event(ID_FIELD => @id_value, "@timestamp" => end_timestamp)
|
183
183
|
@filter.filter(end_event) do |new_event|
|
184
184
|
@match_event = new_event
|
@@ -189,14 +189,14 @@ describe LogStash::Filters::Elapsed do
|
|
189
189
|
it_behaves_like "match event"
|
190
190
|
|
191
191
|
it "contains the 'host field'" do
|
192
|
-
insist { @match_event
|
192
|
+
insist { @match_event.get("host") } == Socket.gethostname
|
193
193
|
end
|
194
194
|
end
|
195
195
|
end
|
196
196
|
|
197
197
|
context "if 'new_event_on_match' is set to 'false'" do
|
198
198
|
before(:each) do
|
199
|
-
end_timestamp = @start_event
|
199
|
+
end_timestamp = @start_event.get("@timestamp") + 10
|
200
200
|
end_event = end_event(ID_FIELD => @id_value, "@timestamp" => end_timestamp)
|
201
201
|
@filter.filter(end_event)
|
202
202
|
|
@@ -264,33 +264,33 @@ describe LogStash::Filters::Elapsed do
|
|
264
264
|
end
|
265
265
|
|
266
266
|
it "creates a new event with tag 'elapsed_expired_error' for each expired 'start event'" do
|
267
|
-
insist { @expired_events[0]
|
268
|
-
insist { @expired_events[1]
|
267
|
+
insist { @expired_events[0].get("tags").include?("elapsed_expired_error") } == true
|
268
|
+
insist { @expired_events[1].get("tags").include?("elapsed_expired_error") } == true
|
269
269
|
end
|
270
270
|
|
271
271
|
it "creates a new event with tag 'elapsed' for each expired 'start event'" do
|
272
|
-
insist { @expired_events[0]
|
273
|
-
insist { @expired_events[1]
|
272
|
+
insist { @expired_events[0].get("tags").include?("elapsed") } == true
|
273
|
+
insist { @expired_events[1].get("tags").include?("elapsed") } == true
|
274
274
|
end
|
275
275
|
|
276
276
|
it "creates a new event containing the 'id field' of the expired 'start event'" do
|
277
|
-
insist { @expired_events[0]
|
278
|
-
insist { @expired_events[1]
|
277
|
+
insist { @expired_events[0].get(ID_FIELD) } == "2"
|
278
|
+
insist { @expired_events[1].get(ID_FIELD) } == "3"
|
279
279
|
end
|
280
280
|
|
281
281
|
it "creates a new event containing an 'elapsed_time field' with the age of the expired 'start event'" do
|
282
|
-
insist { @expired_events[0]
|
283
|
-
insist { @expired_events[1]
|
282
|
+
insist { @expired_events[0].get("elapsed_time") } == 30
|
283
|
+
insist { @expired_events[1].get("elapsed_time") } == 31
|
284
284
|
end
|
285
285
|
|
286
286
|
it "creates a new event containing an 'elapsed_timestamp_start field' with the timestamp of the expired 'start event'" do
|
287
|
-
insist { @expired_events[0]
|
288
|
-
insist { @expired_events[1]
|
287
|
+
insist { @expired_events[0].get("elapsed_timestamp_start") } == @start_event_2.get("@timestamp")
|
288
|
+
insist { @expired_events[1].get("elapsed_timestamp_start") } == @start_event_3.get("@timestamp")
|
289
289
|
end
|
290
290
|
|
291
291
|
it "creates a new event containing a 'host field' for each expired 'start event'" do
|
292
|
-
insist { @expired_events[0]
|
293
|
-
insist { @expired_events[1]
|
292
|
+
insist { @expired_events[0].get("host") } == Socket.gethostname
|
293
|
+
insist { @expired_events[1].get("host") } == Socket.gethostname
|
294
294
|
end
|
295
295
|
end
|
296
296
|
end
|
metadata
CHANGED
@@ -1,29 +1,35 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-elapsed
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 4.0.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2016-
|
11
|
+
date: 2016-11-29 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|
15
15
|
requirements:
|
16
|
-
- - "
|
16
|
+
- - ">="
|
17
|
+
- !ruby/object:Gem::Version
|
18
|
+
version: '1.60'
|
19
|
+
- - "<="
|
17
20
|
- !ruby/object:Gem::Version
|
18
|
-
version: '
|
21
|
+
version: '2.99'
|
19
22
|
name: logstash-core-plugin-api
|
20
23
|
prerelease: false
|
21
24
|
type: :runtime
|
22
25
|
version_requirements: !ruby/object:Gem::Requirement
|
23
26
|
requirements:
|
24
|
-
- - "
|
27
|
+
- - ">="
|
28
|
+
- !ruby/object:Gem::Version
|
29
|
+
version: '1.60'
|
30
|
+
- - "<="
|
25
31
|
- !ruby/object:Gem::Version
|
26
|
-
version: '
|
32
|
+
version: '2.99'
|
27
33
|
- !ruby/object:Gem::Dependency
|
28
34
|
requirement: !ruby/object:Gem::Requirement
|
29
35
|
requirements:
|
@@ -38,7 +44,7 @@ dependencies:
|
|
38
44
|
- - ">="
|
39
45
|
- !ruby/object:Gem::Version
|
40
46
|
version: '0'
|
41
|
-
description: This gem is a
|
47
|
+
description: This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program
|
42
48
|
email: info@elastic.co
|
43
49
|
executables: []
|
44
50
|
extensions: []
|