logstash-filter-elapsed 4.0.5 → 4.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8a2997511503e4d774b26b3cd72f5765ed6eb9777ee0ebb3a1345bd0cb6fae2d
-  data.tar.gz: 53b192a354c291a14d7b7f5e4a7ebd314bdd50e2a9ef5ed379478deee2206683
+  metadata.gz: 62eed374e0f0470f24f6e08cf60524fbfc4c3b49c5e9c069b9047af0fcd2baaf
+  data.tar.gz: fb928437d7978ff7ed34497c8c232e795f65052f139936f01e40be1c0dd2ade6
 SHA512:
-  metadata.gz: fdae5d89068375553ea71238defaac1795c982ab79596f0eb055363ae06dc3e7e1f07c2a885e05793d22160f6a95fc8097e6ac3a3aa90326ab4a3d82576a2aa6
-  data.tar.gz: 7376e6411716eb35f9d10f819e078793c048f2bca8b74a97294f7798e81f4728b45f3dd17e6b7474f002f8698bae8f58558cfdc0e2e9a0abc94bbfed2f0c53a0
+  metadata.gz: a2d64f1c578518e76661be136367c05c840285d769f343152ce976a88731ccddc87958417f85bea93a03a190191f38c6107acda76fe392166a05d6a13ce4b242
+  data.tar.gz: 04dfa3a1d4248d6e7874f218030ab93adfcad256b5da4c153341c8581eed96229f0ca57f7bfbf46aa6252d91d66c61dadbb26809ab31b724adbb9a57d28d7e39

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 4.1.0
+  - Added option `keep_start_event` to manage what to do when several messages matched
+  as a start event were received before the end event for the specified ID.
+  [#35](https://github.com/logstash-plugins/logstash-filter-elapsed/pull/35)
+
 ## 4.0.5
   - Fixed default to true for the periodic_flush option in order for the caching expiration to work [#36](https://github.com/logstash-plugins/logstash-filter-elapsed/pull/36) 
 

data/docs/index.asciidoc

@@ -106,6 +106,7 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-start_tag>> |<<string,string>>|Yes
 | <<plugins-{type}s-{plugin}-timeout>> |<<number,number>>|No
 | <<plugins-{type}s-{plugin}-unique_id_field>> |<<string,string>>|Yes
+| <<plugins-{type}s-{plugin}-keep_start_event>> |<<string,string>>|No
 |=======================================================================
 
 Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
@@ -162,6 +163,17 @@ The name of the field containing the task ID.
 This value must uniquely identify the task in the system, otherwise
 it's impossible to match the couple of events.
 
+[id="plugins-{type}s-{plugin}-keep_start_event"]
+===== `keep_start_event`
+
+  * Value type is <<string,string>>
+  * Default value is `first`
+
+This property manages what to do when several events matched as a start one
+were received before the end event for the specified ID. There are two
+supported values: `first` or `last`. If it's set to `first` (default value),
+the first event matched as a start will be used; if it's set to `last`,
+the last one will be used.
 
 
 [id="plugins-{type}s-{plugin}-common-options"]

data/lib/logstash/filters/elapsed.rb

@@ -109,6 +109,12 @@ class LogStash::Filters::Elapsed < LogStash::Filters::Base
   # to the "end event"; if it's set to `true` a new "match event" is created.
   config :new_event_on_match, :validate => :boolean, :required => false, :default => false
 
+  # This property manage what to do when several "start events" were received
+  # before an "end event" for a concrete ID. If it's set to `first` (default
+  # value), the first "start event" will be used; if it's set to `last`,
+  # the last "start event" will be used.
+  config :keep_start_event, :validate => ['first', 'last'], :required => false, :default => 'first'
+
   # This filter must have its flush function called periodically to be able to purge
   # expired stored start events.
   config :periodic_flush, :validate => :boolean, :default => true
@@ -139,7 +145,7 @@ class LogStash::Filters::Elapsed < LogStash::Filters::Base
       @logger.debug("Elapsed, 'start event' received", start_tag: @start_tag, unique_id_field: @unique_id_field)
 
       @mutex.synchronize do
-        unless(@start_events.has_key?(unique_id))
+        unless(@keep_start_event == 'first' && @start_events.has_key?(unique_id))
           @start_events[unique_id] = LogStash::Filters::Elapsed::Element.new(event)
         end
       end

data/logstash-filter-elapsed.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-elapsed'
-  s.version         = '4.0.5'
+  s.version         = '4.1.0'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Calculates the elapsed time between a pair of events"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

data/spec/filters/elapsed_spec.rb

@@ -74,16 +74,36 @@ describe LogStash::Filters::Elapsed do
     end
 
     describe "receiving two 'start events' for the same id field" do
-      it "keeps the first one and does not save the second one" do
-          args = {"tags" => [START_TAG], ID_FIELD => "id123"}
-          first_event = event(args)
-          second_event = event(args)
+      context "if 'keep_start_event' is set to 'last'" do
+        before(:each) do
+          setup_filter("keep_start_event" => 'last')
+        end
 
-          @filter.filter(first_event)
-          @filter.filter(second_event)
+        it "keeps the second one and does not save the first one" do
+            args = {"tags" => [START_TAG], ID_FIELD => "id123"}
+            first_event = event(args)
+            second_event = event(args)
 
-          insist { @filter.start_events.size } == 1
-          insist { @filter.start_events["id123"].event } == first_event
+            @filter.filter(first_event)
+            @filter.filter(second_event)
+
+            insist { @filter.start_events.size } == 1
+            insist { @filter.start_events["id123"].event } == second_event
+        end
+      end
+
+      context "if 'keep_start_event' is set to 'first'" do
+        it "keeps the first one and does not save the second one" do
+            args = {"tags" => [START_TAG], ID_FIELD => "id123"}
+            first_event = event(args)
+            second_event = event(args)
+
+            @filter.filter(first_event)
+            @filter.filter(second_event)
+
+            insist { @filter.start_events.size } == 1
+            insist { @filter.start_events["id123"].event } == first_event
+        end
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-elapsed
 version: !ruby/object:Gem::Version
-  version: 4.0.5
+  version: 4.1.0
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-06-07 00:00:00.000000000 Z
+date: 2018-07-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement