logstash-filter-emoji 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: c457407f53496f9c1896fab9aeba881f7cb38a67
+  data.tar.gz: 64007a22e81616ac020f1010f9a0d3d223d26b71
+SHA512:
+  metadata.gz: da0358dfb1690e7194fcbd748699be46035301ecb486f81e0f007c59f6b0bed11af32970093156ed9df5604010145a435b9e1170fa0153d83edec2450e3e8603
+  data.tar.gz: eb42aa2f86895d9056c3adc06f15e24b8e513f1e29088e6447c62504f4cb5ba9965f5effa8319bf12ea9e56dfba68aafb33be39dfcef0610c39652c1f9a33dba

data/CHANGELOG.md

@@ -0,0 +1,2 @@
+## 1.0.0
+  - Plugin created

data/CONTRIBUTORS

@@ -0,0 +1,10 @@
+The following is a list of people who have contributed ideas, code, bug
+reports, or in general have helped logstash along its way.
+
+Contributors:
+* Aaron Mildenstein - aaron@mildensteins.com
+
+Note: If you've sent us patches, bug reports, or otherwise contributed to
+Logstash, and you aren't on the list above and want to be, please let us know
+and we'll make sure you're here. Contributions from folks like you are what make
+open source awesome.

data/DEVELOPER.md

@@ -0,0 +1,6 @@
+# logstash-filter-emoji
+Pretty straight, single-purpose filter here.  It catches field values for a
+given field, and swaps them out for an emoji (or whatever you want).
+
+The defaults are listed in the documentation.  Catches RFC 5424 and RFC 3164
+priority values.

data/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+gemspec
+

data/LICENSE

@@ -0,0 +1,11 @@
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

data/README.md

@@ -0,0 +1,86 @@
+# Logstash Plugin
+
+This is a plugin for [Logstash](https://github.com/elastic/logstash).
+
+It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.
+
+## Documentation
+
+Logstash provides infrastructure to automatically generate documentation for this plugin. We use the asciidoc format to write documentation so any comments in the source code will be first converted into asciidoc and then into html. All plugin documentation are placed under one [central location](http://www.elastic.co/guide/en/logstash/current/).
+
+- For formatting code or config example, you can use the asciidoc `[source,ruby]` directive
+- For more asciidoc formatting tips, see the excellent reference here https://github.com/elastic/docs#asciidoc-guide
+
+## Need Help?
+
+Need help? Try #logstash on freenode IRC or the https://discuss.elastic.co/c/logstash discussion forum.
+
+## Developing
+
+### 1. Plugin Developement and Testing
+
+#### Code
+- To get started, you'll need JRuby with the Bundler gem installed.
+
+- Create a new plugin or clone and existing from the GitHub [logstash-plugins](https://github.com/logstash-plugins) organization. We also provide [example plugins](https://github.com/logstash-plugins?query=example).
+
+- Install dependencies
+```sh
+bundle install
+```
+
+#### Test
+
+- Update your dependencies
+
+```sh
+bundle install
+```
+
+- Run tests
+
+```sh
+bundle exec rspec
+```
+
+### 2. Running your unpublished Plugin in Logstash
+
+#### 2.1 Run in a local Logstash clone
+
+- Edit Logstash `Gemfile` and add the local plugin path, for example:
+```ruby
+gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
+```
+- Install plugin
+```sh
+bin/logstash-plugin install --no-verify
+```
+- Run Logstash with your plugin
+```sh
+bin/logstash -e 'filter {awesome {}}'
+```
+At this point any modifications to the plugin code will be applied to this local Logstash setup. After modifying the plugin, simply rerun Logstash.
+
+#### 2.2 Run in an installed Logstash
+
+You can use the same **2.1** method to run your plugin in an installed Logstash by editing its `Gemfile` and pointing the `:path` to your local plugin development directory or you can build the gem and install it using:
+
+- Build your plugin gem
+```sh
+gem build logstash-filter-awesome.gemspec
+```
+- Install the plugin from the Logstash home
+```sh
+bin/logstash-plugin install /your/local/plugin/logstash-filter-awesome.gem
+```
+- Start Logstash and proceed to test the plugin
+
+## Contributing
+
+All contributions are welcome: ideas, patches, documentation, bug reports, complaints, and even something you drew up on a napkin.
+
+Programming is not a required skill. Whatever you've seen about open source and maintainers or community members  saying "send patches or die" - you will not see that here.
+
+It is more important to the community that you are able to contribute.
+
+For more information about contributing, see the [CONTRIBUTING](https://github.com/elastic/logstash/blob/master/CONTRIBUTING.md) file.

data/lib/logstash/filters/emoji.rb

@@ -0,0 +1,111 @@
+# encoding: utf-8
+require "logstash/filters/base"
+require "logstash/namespace"
+
+# This plugin maps the severity names or numeric codes as defined in
+# https://tools.ietf.org/html/rfc3164#section-4.1.1[RFC 3164] and
+# https://tools.ietf.org/html/rfc5424#section-6.2.1[RFC 5424] to the emoji
+# as defined in the configuration.
+
+class LogStash::Filters::Emoji < LogStash::Filters::Base
+
+  config_name "emoji"
+
+  # The name of the logstash event field containing the value to be compared for
+  # a match by the emoji filter (e.g. `severity`).
+  #
+  # If this field is an array, only the first value will be used.
+  config :field, :validate => :string, :required => true
+
+  # If the target field already exists, this configuration item specifies
+  # whether the filter should skip being rewritten as an emoji (default) or
+  # overwrite the target field value with the emoji value.
+  config :override, :validate => :boolean, :default => false
+
+  # `sev_emergency` selects the emoji/unicode character for Emergency severity
+  config :sev_emergency, :validate => :string, :default => "💥"
+  # `sev_alert` selects the emoji/unicode character for Alert severity
+  config :sev_alert, :validate => :string, :default => "🚨"
+  # `sev_critical` selects the emoji/unicode character for Critical severity
+  config :sev_critical, :validate => :string, :default => "🔥"
+  # `sev_error` selects the emoji/unicode character for Error severity
+  config :sev_error, :validate => :string, :default => "❌"
+  # `sev_warning` selects the emoji/unicode character for Warning severity
+  config :sev_warning, :validate => :string, :default => "⚠️"
+  # `sev_notice` selects the emoji/unicode character for Notice severity
+  config :sev_notice, :validate => :string, :default => "👀"
+  # `sev_info` selects the emoji/unicode character for Informational severity
+  config :sev_info, :validate => :string, :default => "ℹ️"
+  # `sev_debug` selects the emoji/unicode character for Debug severity
+  config :sev_debug, :validate => :string, :default => "🐛"
+
+  # The target field you wish to populate with the emoji. The default
+  # is a field named `emoji`. Set this to the same value as the source (`field`)
+  # if you want to do a substitution, in this case filter will allways succeed.
+  # This will overwrite the old value of the source field!
+  config :target, :validate => :string, :default => "emoji"
+
+  # In case no match is found in the event, this will add a default emoji, which
+  # will always populate `target`, if the match failed.
+  #
+  # For example, if we have configured `fallback => "`❓`"`, using this
+  # dictionary:
+  # [source,ruby]
+  #     foo: 👤
+  #
+  # Then, if logstash received an event with the field `foo` set to 👤, the
+  # target field would be set to 👤. However, if logstash received an event with
+  # `foo` set to `nope`, then the target field would still be populated, but
+  # with the value of ❓.
+  # This configuration can be dynamic and include parts of the event using the
+  # `%{field}` syntax.
+  config :fallback, :validate => :string
+
+  public
+  def register
+    @dictionary = {
+       "^0$|Emergency|EMERGENCY|emerg|EMERG" => @sev_emergency,
+       "^1$|Alert|ALERT|alert" => @sev_alert,
+       "^2$|Critical|CRITICAL|crit|CRIT" => @sev_critical,
+       "^3$|Error|ERROR|err|ERR" => @sev_error,
+       "^4$|Warning|WARNING|warn|WARN" => @sev_warning,
+       "^5$|Notice|NOTICE|notice" => @sev_notice,
+       "^6$|Informational|INFORMATIONAL|info|INFO" => @sev_info,
+       "^7$|Debug|DEBUG|debug" => @sev_debug
+    }
+    @logger.debug? and @logger.debug("#{self.class.name}: Dictionary - ", :dictionary => @dictionary)
+    if @exact
+      @logger.debug? and @logger.debug("#{self.class.name}: Dictionary matching method - Exact")
+    else
+      @logger.debug? and @logger.debug("#{self.class.name}: Dictionary matching method - Fuzzy")
+    end
+  end # def register
+
+  public
+  def filter(event)
+    return unless event.include?(@field) # Skip if event does not have specified field.
+    return if event.include?(@target) and not @override # Skip if @target field already exists and @override is false.
+
+    begin
+      #If source field is array use first value and make sure source value is string
+      source = event.get(@field).is_a?(Array) ? event.get(@field).first.to_s : event.get(@field).to_s
+      matched = false
+      key = @dictionary.keys.detect{|k| source.match(Regexp.new(k))}
+      if key
+        event.set(@target, @dictionary[key] )
+        metric.increment(:matches)
+        matched = true
+      end
+
+      if not matched and @fallback
+        event.set(@target, event.sprintf(@fallback))
+        metric.increment(:matches)
+        matched = true
+      end
+      filter_matched(event) if matched or @field == @target
+    rescue Exception => e
+      metric.increment(:failures)
+      @logger.error("Something went wrong when attempting to match from dictionary", :exception => e, :field => @field, :event => event)
+    end
+  end # def filter
+end # class LogStash::Filters::Emoji

data/logstash-filter-emoji.gemspec

@@ -0,0 +1,23 @@
+Gem::Specification.new do |s|
+  s.name          = 'logstash-filter-emoji'
+  s.version       = '1.0.0'
+  s.licenses      = ['Apache License (2.0)']
+  s.summary         = "The emoji filter allows you to match field values with emoji and either replace them, or insert the emoji into a target field"
+  s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
+  s.authors         = ["Elastic"]
+  s.email           = 'info@elastic.co'
+  s.homepage        = "http://www.elastic.co/guide/en/logstash/current/index.html"
+  s.require_paths = ['lib']
+
+  # Files
+  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
+   # Tests
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
+  s.add_development_dependency 'logstash-devutils'
+end

data/spec/filters/emoji_spec.rb

@@ -0,0 +1,148 @@
+# encoding: utf-8
+require_relative '../spec_helper'
+require "logstash/filters/emoji"
+
+describe LogStash::Filters::Emoji do
+  let(:config) { Hash.new }
+  subject { described_class.new(config) }
+
+  describe "user-defined match" do
+
+    let(:config) do
+      {
+        "field"       => "status",
+        "target"      => "foo",
+        "sev_notice"  => "🆗"
+      }
+    end
+
+    let(:event) { LogStash::Event.new("status" => "notice") }
+
+    it "returns the selected emoji" do
+      subject.register
+      subject.filter(event)
+      expect(event.get("foo")).to eq("🆗")
+    end
+  end
+
+  describe "defalt severities" do
+
+    let(:config) do
+      {
+        "field"       => "severity",
+        "target"      => "foo"
+      }
+    end
+
+    describe "emergency" do
+      let(:event) { LogStash::Event.new("severity" => "0") }
+      it "returns the default emoji" do
+        subject.register
+        subject.filter(event)
+        expect(event.get("foo")).to eq("💥")
+      end
+    end
+
+    describe "alert" do
+      let(:event) { LogStash::Event.new("severity" => "1") }
+      it "returns the default emoji" do
+        subject.register
+        subject.filter(event)
+        expect(event.get("foo")).to eq("🚨")
+      end
+    end
+
+    describe "critical" do
+      let(:event) { LogStash::Event.new("severity" => "2") }
+      it "returns the default emoji" do
+        subject.register
+        subject.filter(event)
+        expect(event.get("foo")).to eq("🔥")
+      end
+    end
+
+    describe "error" do
+      let(:event) { LogStash::Event.new("severity" => "3") }
+      it "returns the default emoji" do
+        subject.register
+        subject.filter(event)
+        expect(event.get("foo")).to eq("❌")
+      end
+    end
+
+    describe "warning" do
+      let(:event) { LogStash::Event.new("severity" => "4") }
+      it "returns the default emoji" do
+        subject.register
+        subject.filter(event)
+        expect(event.get("foo")).to eq("⚠️")
+      end
+    end
+
+    describe "notice" do
+      let(:event) { LogStash::Event.new("severity" => "5") }
+      it "returns the default emoji" do
+        subject.register
+        subject.filter(event)
+        expect(event.get("foo")).to eq("👀")
+      end
+    end
+
+    describe "informational" do
+      let(:event) { LogStash::Event.new("severity" => "6") }
+      it "returns the default emoji" do
+        subject.register
+        subject.filter(event)
+        expect(event.get("foo")).to eq("ℹ️")
+      end
+    end
+
+    describe "debug" do
+      let(:event) { LogStash::Event.new("severity" => "7") }
+      it "returns the default emoji" do
+        subject.register
+        subject.filter(event)
+        expect(event.get("foo")).to eq("🐛")
+      end
+    end
+  end
+
+  describe "fallback value" do
+
+    context "static configuration" do
+      let(:config) do
+        {
+          "field"       => "status",
+          "target"      => "foo",
+          "fallback"    => "👀"
+        }
+      end
+
+      let(:event) { LogStash::Event.new("status" => "200") }
+
+      it "returns the fallback emoji" do
+        subject.register
+        subject.filter(event)
+        expect(event.get("foo")).to eq("👀")
+      end
+    end
+
+    context "allow sprintf" do
+      let(:config) do
+        {
+          "field"    => "status",
+          "target"   => "foo",
+          "fallback" => "%{missing_match}"
+        }
+      end
+
+      let(:event) { LogStash::Event.new("status" => "200", "missing_match" => "missing no match") }
+
+      it "returns the sprintf string" do
+        subject.register
+        subject.filter(event)
+        expect(event.get("foo")).to eq("missing no match")
+      end
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,2 @@
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"

metadata

@@ -0,0 +1,85 @@
+--- !ruby/object:Gem::Specification
+name: logstash-filter-emoji
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Elastic
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2017-03-08 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  name: logstash-core-plugin-api
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  name: logstash-devutils
+  prerelease: false
+  type: :development
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program
+email: info@elastic.co
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- CONTRIBUTORS
+- DEVELOPER.md
+- Gemfile
+- LICENSE
+- README.md
+- lib/logstash/filters/emoji.rb
+- logstash-filter-emoji.gemspec
+- spec/filters/emoji_spec.rb
+- spec/spec_helper.rb
+homepage: http://www.elastic.co/guide/en/logstash/current/index.html
+licenses:
+- Apache License (2.0)
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: filter
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project:
+rubygems_version: 2.4.8
+signing_key:
+specification_version: 4
+summary: The emoji filter allows you to match field values with emoji and either replace them, or insert the emoji into a target field
+test_files:
+- spec/filters/emoji_spec.rb
+- spec/spec_helper.rb