logstash-filter-grok 2.0.3 → 2.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +4 -0
- data/lib/logstash/filters/grok.rb +28 -17
- data/logstash-filter-grok.gemspec +2 -2
- data/spec/filters/grok_spec.rb +52 -8
- metadata +26 -32
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 4f63a7bd21e2ebab75a4cc94f26731323f8912f7
|
4
|
+
data.tar.gz: a2ae27830a99ac4b0bdeb2a2ff76c8e1f691e1f3
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 872e7daf89f4af9d5d92ceea3ba791b24fd358e1a1f7e5d738032b2f90286b256ad544ae06a24231c290535526efaef3a772fbb81e09f991928b17521ce83563
|
7
|
+
data.tar.gz: 4a8ff939e59d6c704946618e315b17df72ae5fedaa2cdd9449652c22f4987f14458f31e15d8bbd9b63e6f0d371c85585143de1676b8e30485e528871a006a009
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,7 @@
|
|
1
|
+
# 2.0.5
|
2
|
+
- Depend on logstash-core-plugin-api instead of logstash-core, removing the need to mass update plugins on major releases of logstash
|
3
|
+
# 2.0.4
|
4
|
+
- New dependency requirements for logstash-core for the 5.0 release
|
1
5
|
## 2.0.3
|
2
6
|
- fix fieldref assignment to avoid assumption on mutable object
|
3
7
|
## 2.0.0
|
@@ -83,7 +83,7 @@
|
|
83
83
|
#
|
84
84
|
# Grok sits on top of regular expressions, so any regular expressions are valid
|
85
85
|
# in grok as well. The regular expression library is Oniguruma, and you can see
|
86
|
-
# the full supported regexp syntax https://github.com/kkos/oniguruma/blob/master/doc/RE[on the
|
86
|
+
# the full supported regexp syntax https://github.com/kkos/oniguruma/blob/master/doc/RE[on the Oniguruma
|
87
87
|
# site].
|
88
88
|
#
|
89
89
|
# ==== Custom Patterns
|
@@ -120,7 +120,7 @@
|
|
120
120
|
# [source,ruby]
|
121
121
|
# filter {
|
122
122
|
# grok {
|
123
|
-
# patterns_dir => "./patterns"
|
123
|
+
# patterns_dir => ["./patterns"]
|
124
124
|
# match => { "message" => "%{SYSLOGBASE} %{POSTFIX_QUEUEID:queue_id}: %{GREEDYDATA:syslog_message}" }
|
125
125
|
# }
|
126
126
|
# }
|
@@ -166,8 +166,8 @@
|
|
166
166
|
# Logstash ships by default with a bunch of patterns, so you don't
|
167
167
|
# necessarily need to define this yourself unless you are adding additional
|
168
168
|
# patterns. You can point to multiple pattern directories using this setting
|
169
|
-
# Note that Grok will read all files in the directory
|
170
|
-
# file (including any tilde backup files)
|
169
|
+
# Note that Grok will read all files in the directory matching the patterns_files_glob
|
170
|
+
# and assume its a pattern file (including any tilde backup files)
|
171
171
|
# [source,ruby]
|
172
172
|
# patterns_dir => ["/opt/logstash/patterns", "/opt/logstash/extra_patterns"]
|
173
173
|
#
|
@@ -180,6 +180,10 @@
|
|
180
180
|
# NUMBER \d+
|
181
181
|
config :patterns_dir, :validate => :array, :default => []
|
182
182
|
|
183
|
+
# Glob pattern, used to select the pattern files in the directories
|
184
|
+
# specified by patterns_dir
|
185
|
+
config :patterns_files_glob, :validate => :string, :default => "*"
|
186
|
+
|
183
187
|
# Break on first match. The first successful match by grok will result in the
|
184
188
|
# filter being finished. If you want grok to try all patterns (maybe you are
|
185
189
|
# parsing different things), then set this to false.
|
@@ -241,19 +245,9 @@
|
|
241
245
|
|
242
246
|
# Have @@patterns_path show first. Last-in pattern definitions win; this
|
243
247
|
# will let folks redefine built-in patterns at runtime.
|
244
|
-
@
|
245
|
-
@
|
246
|
-
|
247
|
-
if File.directory?(path)
|
248
|
-
path = File.join(path, "*")
|
249
|
-
end
|
250
|
-
|
251
|
-
Dir.glob(path).each do |file|
|
252
|
-
@logger.info? and @logger.info("Grok loading patterns from file", :path => file)
|
253
|
-
@patternfiles << file
|
254
|
-
end
|
255
|
-
end
|
256
|
-
|
248
|
+
@patternfiles += patterns_files_from_paths(@@patterns_path.to_a, "*")
|
249
|
+
@patternfiles += patterns_files_from_paths(@patterns_dir, @patterns_files_glob)
|
250
|
+
|
257
251
|
@patterns = Hash.new { |h,k| h[k] = [] }
|
258
252
|
|
259
253
|
@logger.info? and @logger.info("Match data", :match => @match)
|
@@ -352,6 +346,23 @@
|
|
352
346
|
end
|
353
347
|
end
|
354
348
|
|
349
|
+
private
|
350
|
+
def patterns_files_from_paths(paths, glob)
|
351
|
+
patternfiles = []
|
352
|
+
@logger.info? and @logger.info("Grok patterns path", :paths => paths)
|
353
|
+
paths.each do |path|
|
354
|
+
if File.directory?(path)
|
355
|
+
path = File.join(path, glob)
|
356
|
+
end
|
357
|
+
|
358
|
+
Dir.glob(path).each do |file|
|
359
|
+
@logger.info? and @logger.info("Grok loading patterns from file", :path => file)
|
360
|
+
patternfiles << file
|
361
|
+
end
|
362
|
+
end
|
363
|
+
patternfiles
|
364
|
+
end # def patterns_files_from_paths
|
365
|
+
|
355
366
|
private
|
356
367
|
def add_patterns_from_files(paths, grok)
|
357
368
|
paths.each do |path|
|
@@ -1,7 +1,7 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-grok'
|
4
|
-
s.version = '2.0.
|
4
|
+
s.version = '2.0.5'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "Parse arbitrary text and structure it."
|
7
7
|
s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
|
@@ -20,7 +20,7 @@ Gem::Specification.new do |s|
|
|
20
20
|
s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
|
21
21
|
|
22
22
|
# Gem dependencies
|
23
|
-
s.add_runtime_dependency "logstash-core", "
|
23
|
+
s.add_runtime_dependency "logstash-core-plugin-api", "~> 1.0"
|
24
24
|
|
25
25
|
s.add_runtime_dependency 'jls-grok', '~> 0.11.1'
|
26
26
|
s.add_runtime_dependency 'logstash-patterns-core'
|
data/spec/filters/grok_spec.rb
CHANGED
@@ -1,11 +1,21 @@
|
|
1
1
|
# encoding: utf-8
|
2
2
|
require "logstash/devutils/rspec/spec_helper"
|
3
3
|
|
4
|
-
|
5
|
-
|
6
|
-
#
|
7
|
-
|
8
|
-
|
4
|
+
|
5
|
+
module LogStash::Environment
|
6
|
+
# running the grok code outside a logstash package means
|
7
|
+
# LOGSTASH_HOME will not be defined, so let's set it here
|
8
|
+
# before requiring the grok filter
|
9
|
+
unless self.const_defined?(:LOGSTASH_HOME)
|
10
|
+
LOGSTASH_HOME = File.expand_path("../../../", __FILE__)
|
11
|
+
end
|
12
|
+
|
13
|
+
# also :pattern_path method must exist so we define it too
|
14
|
+
unless self.method_defined?(:pattern_path)
|
15
|
+
def pattern_path(path)
|
16
|
+
::File.join(LOGSTASH_HOME, "patterns", path)
|
17
|
+
end
|
18
|
+
end
|
9
19
|
end
|
10
20
|
|
11
21
|
require "logstash/filters/grok"
|
@@ -661,7 +671,7 @@ describe LogStash::Filters::Grok do
|
|
661
671
|
|
662
672
|
before do
|
663
673
|
FileUtils.mkdir(pattern_dir) unless has_pattern_dir?
|
664
|
-
@file = Tempfile.new('grok', pattern_dir)
|
674
|
+
@file = Tempfile.new('grok', pattern_dir)
|
665
675
|
@file.write('WORD \b[2-5]\b')
|
666
676
|
@file.close
|
667
677
|
end
|
@@ -690,8 +700,12 @@ describe LogStash::Filters::Grok do
|
|
690
700
|
|
691
701
|
before do
|
692
702
|
FileUtils.mkdir(pattern_dir) unless has_pattern_dir?
|
693
|
-
@file1 = Tempfile.new('grok', pattern_dir)
|
694
|
-
@
|
703
|
+
@file1 = Tempfile.new('grok', pattern_dir)
|
704
|
+
@file1.write('WORD \b[2-5]\b')
|
705
|
+
@file1.close
|
706
|
+
@file2 = Tempfile.new('grok', tmpdir)
|
707
|
+
@file2.write('WORD \b[0-1]\b')
|
708
|
+
@file2.close
|
695
709
|
end
|
696
710
|
|
697
711
|
let(:config) do
|
@@ -710,6 +724,36 @@ describe LogStash::Filters::Grok do
|
|
710
724
|
end
|
711
725
|
end
|
712
726
|
|
727
|
+
describe "patterns with file glob" do
|
728
|
+
require 'tmpdir'
|
729
|
+
require 'tempfile'
|
730
|
+
|
731
|
+
let(:tmpdir) { Dir.mktmpdir(nil, "/tmp") }
|
732
|
+
|
733
|
+
before do
|
734
|
+
@file3 = Tempfile.new(['grok', '.pattern'], tmpdir)
|
735
|
+
@file3.write('WORD \b[0-1]\b')
|
736
|
+
@file3.close
|
737
|
+
@file4 = Tempfile.new(['grok', '.pattern.old'], tmpdir)
|
738
|
+
@file4.write('WORD \b[2-5]\b')
|
739
|
+
@file4.close
|
740
|
+
end
|
741
|
+
|
742
|
+
let(:config) do
|
743
|
+
"filter { grok { patterns_dir => \"#{tmpdir}\" patterns_files_glob => \"*.pattern\" pattern => \"%{WORD:word}\" } }"
|
744
|
+
end
|
745
|
+
|
746
|
+
sample("message" => '0') do
|
747
|
+
insist { subject["tags"] } == nil
|
748
|
+
end
|
749
|
+
|
750
|
+
after do
|
751
|
+
@file3.unlink
|
752
|
+
@file4.unlink
|
753
|
+
FileUtils.remove_entry tmpdir
|
754
|
+
end
|
755
|
+
end
|
756
|
+
|
713
757
|
describe "grok with nil coerced value" do
|
714
758
|
config <<-CONFIG
|
715
759
|
filter {
|
metadata
CHANGED
@@ -1,77 +1,71 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-grok
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 2.0.
|
4
|
+
version: 2.0.5
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2016-03-24 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
|
-
name: logstash-core
|
15
|
-
version_requirements: !ruby/object:Gem::Requirement
|
16
|
-
requirements:
|
17
|
-
- - '>='
|
18
|
-
- !ruby/object:Gem::Version
|
19
|
-
version: 2.0.0.beta2
|
20
|
-
- - <
|
21
|
-
- !ruby/object:Gem::Version
|
22
|
-
version: 3.0.0
|
23
14
|
requirement: !ruby/object:Gem::Requirement
|
24
15
|
requirements:
|
25
|
-
- -
|
26
|
-
- !ruby/object:Gem::Version
|
27
|
-
version: 2.0.0.beta2
|
28
|
-
- - <
|
16
|
+
- - "~>"
|
29
17
|
- !ruby/object:Gem::Version
|
30
|
-
version:
|
18
|
+
version: '1.0'
|
19
|
+
name: logstash-core-plugin-api
|
31
20
|
prerelease: false
|
32
21
|
type: :runtime
|
33
|
-
- !ruby/object:Gem::Dependency
|
34
|
-
name: jls-grok
|
35
22
|
version_requirements: !ruby/object:Gem::Requirement
|
36
23
|
requirements:
|
37
|
-
- - ~>
|
24
|
+
- - "~>"
|
38
25
|
- !ruby/object:Gem::Version
|
39
|
-
version: 0
|
26
|
+
version: '1.0'
|
27
|
+
- !ruby/object:Gem::Dependency
|
40
28
|
requirement: !ruby/object:Gem::Requirement
|
41
29
|
requirements:
|
42
|
-
- - ~>
|
30
|
+
- - "~>"
|
43
31
|
- !ruby/object:Gem::Version
|
44
32
|
version: 0.11.1
|
33
|
+
name: jls-grok
|
45
34
|
prerelease: false
|
46
35
|
type: :runtime
|
47
|
-
- !ruby/object:Gem::Dependency
|
48
|
-
name: logstash-patterns-core
|
49
36
|
version_requirements: !ruby/object:Gem::Requirement
|
50
37
|
requirements:
|
51
|
-
- -
|
38
|
+
- - "~>"
|
52
39
|
- !ruby/object:Gem::Version
|
53
|
-
version:
|
40
|
+
version: 0.11.1
|
41
|
+
- !ruby/object:Gem::Dependency
|
54
42
|
requirement: !ruby/object:Gem::Requirement
|
55
43
|
requirements:
|
56
|
-
- -
|
44
|
+
- - ">="
|
57
45
|
- !ruby/object:Gem::Version
|
58
46
|
version: '0'
|
47
|
+
name: logstash-patterns-core
|
59
48
|
prerelease: false
|
60
49
|
type: :runtime
|
61
|
-
- !ruby/object:Gem::Dependency
|
62
|
-
name: logstash-devutils
|
63
50
|
version_requirements: !ruby/object:Gem::Requirement
|
64
51
|
requirements:
|
65
|
-
- -
|
52
|
+
- - ">="
|
66
53
|
- !ruby/object:Gem::Version
|
67
54
|
version: '0'
|
55
|
+
- !ruby/object:Gem::Dependency
|
68
56
|
requirement: !ruby/object:Gem::Requirement
|
69
57
|
requirements:
|
70
|
-
- -
|
58
|
+
- - ">="
|
71
59
|
- !ruby/object:Gem::Version
|
72
60
|
version: '0'
|
61
|
+
name: logstash-devutils
|
73
62
|
prerelease: false
|
74
63
|
type: :development
|
64
|
+
version_requirements: !ruby/object:Gem::Requirement
|
65
|
+
requirements:
|
66
|
+
- - ">="
|
67
|
+
- !ruby/object:Gem::Version
|
68
|
+
version: '0'
|
75
69
|
description: This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program
|
76
70
|
email: info@elastic.co
|
77
71
|
executables: []
|
@@ -99,12 +93,12 @@ require_paths:
|
|
99
93
|
- lib
|
100
94
|
required_ruby_version: !ruby/object:Gem::Requirement
|
101
95
|
requirements:
|
102
|
-
- -
|
96
|
+
- - ">="
|
103
97
|
- !ruby/object:Gem::Version
|
104
98
|
version: '0'
|
105
99
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
106
100
|
requirements:
|
107
|
-
- -
|
101
|
+
- - ">="
|
108
102
|
- !ruby/object:Gem::Version
|
109
103
|
version: '0'
|
110
104
|
requirements: []
|