logstash-filter-grok 0.1.2 → 0.1.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CONTRIBUTORS +39 -0
- data/LICENSE +1 -1
- data/README.md +95 -0
- data/lib/logstash/filters/grok.rb +6 -5
- data/logstash-filter-grok.gemspec +1 -1
- data/spec/filters/grok_spec.rb +50 -0
- metadata +4 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 214248989cc378b5b01f4e9b6c41fa35e96fd1c6
|
4
|
+
data.tar.gz: 5a4c985d51c98a2826ae0e76e035d995fb6345b6
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 0d044b8680cd9a1c38a3f2a9d1bcb4e219a560abe7e6e5ff54847e96c2b0734a1f6a688cc4297f142b4efbde12397271a55a1af3a1305b3a7a19078f06014539
|
7
|
+
data.tar.gz: c6d2856873a1df6d354112d0f13e9e1a5c8bb3cfbc6a7923b32a262ac7c1312729676643203fddda488753aa7869c7e4505c236f84f1e78498e6f3d02e541a12
|
data/CONTRIBUTORS
ADDED
@@ -0,0 +1,39 @@
|
|
1
|
+
The following is a list of people who have contributed ideas, code, bug
|
2
|
+
reports, or in general have helped logstash along its way.
|
3
|
+
|
4
|
+
Contributors:
|
5
|
+
* Aaron Mildenstein (untergeek)
|
6
|
+
* Brad Fritz (bfritz)
|
7
|
+
* Colin Surprenant (colinsurprenant)
|
8
|
+
* Dr. Alexander Papaspyrou (lxndrp)
|
9
|
+
* Ehtesh Choudhury (shurane)
|
10
|
+
* Greg Brockman (gdb)
|
11
|
+
* Guillaume ESPANEL (quatre)
|
12
|
+
* Hugo Lopes Tavares (hltbra)
|
13
|
+
* Jake Crosby (jakecr)
|
14
|
+
* James Turnbull (jamtur01)
|
15
|
+
* Jason Kendall (coolacid)
|
16
|
+
* Jeff Forcier (bitprophet)
|
17
|
+
* John E. Vincent (lusis)
|
18
|
+
* Jordan Sissel (jordansissel)
|
19
|
+
* João Duarte (jsvd)
|
20
|
+
* Justin Lambert (jlambert121)
|
21
|
+
* Kurt Hurtado (kurtado)
|
22
|
+
* Martijn Heemels (Yggdrasil)
|
23
|
+
* Neil Prosser (neilprosser)
|
24
|
+
* Nick Ethier (nickethier)
|
25
|
+
* Pete Fritchman (fetep)
|
26
|
+
* Peter Fern (pdf)
|
27
|
+
* Philippe Weber (wiibaa)
|
28
|
+
* Pier-Hugues Pellerin (ph)
|
29
|
+
* Richard Pijnenburg (electrical)
|
30
|
+
* Suyog Rao (suyograo)
|
31
|
+
* Yanis Guenane (Spredzy)
|
32
|
+
* debadair
|
33
|
+
* piavlo
|
34
|
+
* yjpa7145
|
35
|
+
|
36
|
+
Note: If you've sent us patches, bug reports, or otherwise contributed to
|
37
|
+
Logstash, and you aren't on the list above and want to be, please let us know
|
38
|
+
and we'll make sure you're here. Contributions from folks like you are what make
|
39
|
+
open source awesome.
|
data/LICENSE
CHANGED
@@ -1,4 +1,4 @@
|
|
1
|
-
Copyright (c) 2012-
|
1
|
+
Copyright (c) 2012-2015 Elasticsearch <http://www.elasticsearch.org>
|
2
2
|
|
3
3
|
Licensed under the Apache License, Version 2.0 (the "License");
|
4
4
|
you may not use this file except in compliance with the License.
|
data/README.md
ADDED
@@ -0,0 +1,95 @@
|
|
1
|
+
# Logstash Plugin
|
2
|
+
|
3
|
+
This is a plugin for [Logstash](https://github.com/elasticsearch/logstash).
|
4
|
+
|
5
|
+
It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.
|
6
|
+
|
7
|
+
## Documentation
|
8
|
+
|
9
|
+
Logstash provides infrastructure to automatically generate documentation for this plugin. We use the asciidoc format to write documentation so any comments in the source code will be first converted into asciidoc and then into html. All plugin documentation are placed under one [central location](http://www.elasticsearch.org/guide/en/logstash/current/).
|
10
|
+
|
11
|
+
- For formatting code or config example, you can use the asciidoc `[source,ruby]` directive
|
12
|
+
- For more asciidoc formatting tips, see the excellent reference here https://github.com/elasticsearch/docs#asciidoc-guide
|
13
|
+
|
14
|
+
## Need Help?
|
15
|
+
|
16
|
+
Need help? Try #logstash on freenode IRC or the logstash-users@googlegroups.com mailing list.
|
17
|
+
|
18
|
+
## Developing
|
19
|
+
|
20
|
+
### 1. Plugin Developement and Testing
|
21
|
+
|
22
|
+
#### Code
|
23
|
+
- To get started, you'll need JRuby with the Bundler gem installed.
|
24
|
+
|
25
|
+
- Create a new plugin or clone and existing from the GitHub [logstash-plugins](https://github.com/logstash-plugins) organization.
|
26
|
+
|
27
|
+
- Install dependencies
|
28
|
+
```sh
|
29
|
+
bundle install
|
30
|
+
```
|
31
|
+
|
32
|
+
#### Test
|
33
|
+
|
34
|
+
```sh
|
35
|
+
bundle exec rspec
|
36
|
+
```
|
37
|
+
|
38
|
+
The Logstash code required to run the tests/specs is specified in the `Gemfile` by the line similar to:
|
39
|
+
```ruby
|
40
|
+
gem "logstash", :github => "elasticsearch/logstash", :branch => "1.5"
|
41
|
+
```
|
42
|
+
To test against another version or a local Logstash, edit the `Gemfile` to specify an alternative location, for example:
|
43
|
+
```ruby
|
44
|
+
gem "logstash", :github => "elasticsearch/logstash", :ref => "master"
|
45
|
+
```
|
46
|
+
```ruby
|
47
|
+
gem "logstash", :path => "/your/local/logstash"
|
48
|
+
```
|
49
|
+
|
50
|
+
Then update your dependencies and run your tests:
|
51
|
+
|
52
|
+
```sh
|
53
|
+
bundle install
|
54
|
+
bundle exec rspec
|
55
|
+
```
|
56
|
+
|
57
|
+
### 2. Running your unpublished Plugin in Logstash
|
58
|
+
|
59
|
+
#### 2.1 Run in a local Logstash clone
|
60
|
+
|
61
|
+
- Edit Logstash `tools/Gemfile` and add the local plugin path, for example:
|
62
|
+
```ruby
|
63
|
+
gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
|
64
|
+
```
|
65
|
+
- Update Logstash dependencies
|
66
|
+
```sh
|
67
|
+
rake vendor:gems
|
68
|
+
```
|
69
|
+
- Run Logstash with your plugin
|
70
|
+
```sh
|
71
|
+
bin/logstash -e 'filter {awesome {}}'
|
72
|
+
```
|
73
|
+
At this point any modifications to the plugin code will be applied to this local Logstash setup. After modifying the plugin, simply rerun Logstash.
|
74
|
+
|
75
|
+
#### 2.2 Run in an installed Logstash
|
76
|
+
|
77
|
+
- Build your plugin gem
|
78
|
+
```sh
|
79
|
+
gem build logstash-filter-awesome.gemspec
|
80
|
+
```
|
81
|
+
- Install the plugin from the Logstash home
|
82
|
+
```sh
|
83
|
+
bin/plugin install /your/local/plugin/logstash-filter-awesome.gem
|
84
|
+
```
|
85
|
+
- Start Logstash and proceed to test the plugin
|
86
|
+
|
87
|
+
## Contributing
|
88
|
+
|
89
|
+
All contributions are welcome: ideas, patches, documentation, bug reports, complaints, and even something you drew up on a napkin.
|
90
|
+
|
91
|
+
Programming is not a required skill. Whatever you've seen about open source and maintainers or community members saying "send patches or die" - you will not see that here.
|
92
|
+
|
93
|
+
It is more important to me that you are able to contribute.
|
94
|
+
|
95
|
+
For more information about contributing, see the [CONTRIBUTING](https://github.com/elasticsearch/logstash/blob/master/CONTRIBUTING.md) file.
|
@@ -15,7 +15,7 @@
|
|
15
15
|
# and not computer consumption.
|
16
16
|
#
|
17
17
|
# Logstash ships with about 120 patterns by default. You can find them here:
|
18
|
-
# <https://github.com/logstash/logstash/tree/
|
18
|
+
# <https://github.com/logstash-plugins/logstash-patterns-core/tree/master/patterns>. You can add
|
19
19
|
# your own trivially. (See the `patterns_dir` setting)
|
20
20
|
#
|
21
21
|
# If you need help building patterns to match your logs, you will find the
|
@@ -138,7 +138,6 @@
|
|
138
138
|
# `SYSLOGBASE` pattern which itself is defined by other patterns.
|
139
139
|
class LogStash::Filters::Grok < LogStash::Filters::Base
|
140
140
|
config_name "grok"
|
141
|
-
milestone 3
|
142
141
|
|
143
142
|
# Specify a pattern to parse with. This will match the `message` field.
|
144
143
|
#
|
@@ -213,10 +212,12 @@
|
|
213
212
|
# will be parsed and `hello world` will overwrite the original message.
|
214
213
|
config :overwrite, :validate => :array, :default => []
|
215
214
|
|
216
|
-
#
|
215
|
+
# Register default pattern paths
|
217
216
|
@@patterns_path ||= Set.new
|
218
|
-
|
219
|
-
|
217
|
+
@@patterns_path += [
|
218
|
+
LogStash::Patterns::Core.path,
|
219
|
+
LogStash::Environment.pattern_path("*")
|
220
|
+
]
|
220
221
|
|
221
222
|
public
|
222
223
|
def initialize(params)
|
@@ -1,7 +1,7 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-grok'
|
4
|
-
s.version = '0.1.
|
4
|
+
s.version = '0.1.3'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "Parse arbitrary text and structure it."
|
7
7
|
s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
|
data/spec/filters/grok_spec.rb
CHANGED
@@ -644,5 +644,55 @@ describe LogStash::Filters::Grok do
|
|
644
644
|
end
|
645
645
|
end
|
646
646
|
|
647
|
+
describe "patterns in the 'patterns/' dir override core patterns" do
|
648
|
+
require 'tmpdir'
|
649
|
+
require 'tempfile'
|
650
|
+
|
651
|
+
before do
|
652
|
+
pattern_dir = File.join(LogStash::Environment::LOGSTASH_HOME, "patterns")
|
653
|
+
@file = Tempfile.new('grok', pattern_dir);
|
654
|
+
@file.write('WORD \b[2-5]\b')
|
655
|
+
@file.rewind
|
656
|
+
end
|
657
|
+
|
658
|
+
let(:config) do
|
659
|
+
'filter { grok { pattern => "%{WORD:word}" } }'
|
660
|
+
end
|
661
|
+
|
662
|
+
sample("message" => 'hello') do
|
663
|
+
insist { subject["tags"] } == ["_grokparsefailure"]
|
664
|
+
end
|
665
|
+
|
666
|
+
after do
|
667
|
+
@file.close; @file.unlink
|
668
|
+
end
|
669
|
+
end
|
670
|
+
|
671
|
+
describe "patterns in custom dir override those in 'patterns/' dir" do
|
672
|
+
require 'tmpdir'
|
673
|
+
require 'tempfile'
|
674
|
+
|
675
|
+
let(:tmpdir) { Dir.mktmpdir }
|
676
|
+
|
677
|
+
before do
|
678
|
+
pattern_dir = File.join(LogStash::Environment::LOGSTASH_HOME, "patterns")
|
679
|
+
@file1 = Tempfile.new('grok', pattern_dir); @file1.write('WORD \b[2-5]\b'); @file1.rewind
|
680
|
+
@file2 = Tempfile.new('grok', tmpdir); @file2.write('WORD \b[0-1]\b'); @file2.rewind
|
681
|
+
end
|
682
|
+
|
683
|
+
let(:config) do
|
684
|
+
"filter { grok { patterns_dir => \"#{tmpdir}\" pattern => \"%{WORD:word}\" } }"
|
685
|
+
end
|
686
|
+
|
687
|
+
sample("message" => '0') do
|
688
|
+
insist { subject["tags"] } == nil
|
689
|
+
end
|
690
|
+
|
691
|
+
after do
|
692
|
+
@file1.close; @file1.unlink
|
693
|
+
@file2.close; @file2.unlink
|
694
|
+
FileUtils.remove_entry tmpdir
|
695
|
+
end
|
696
|
+
end
|
647
697
|
|
648
698
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-grok
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.1.
|
4
|
+
version: 0.1.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elasticsearch
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2015-01-27 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|
@@ -93,8 +93,10 @@ extensions: []
|
|
93
93
|
extra_rdoc_files: []
|
94
94
|
files:
|
95
95
|
- .gitignore
|
96
|
+
- CONTRIBUTORS
|
96
97
|
- Gemfile
|
97
98
|
- LICENSE
|
99
|
+
- README.md
|
98
100
|
- Rakefile
|
99
101
|
- lib/logstash/filters/grok.rb
|
100
102
|
- logstash-filter-grok.gemspec
|