logstash-filter-grok 2.0.3 → 2.0.5
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +4 -0
- data/lib/logstash/filters/grok.rb +28 -17
- data/logstash-filter-grok.gemspec +2 -2
- data/spec/filters/grok_spec.rb +52 -8
- metadata +26 -32
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 4f63a7bd21e2ebab75a4cc94f26731323f8912f7
|
4
|
+
data.tar.gz: a2ae27830a99ac4b0bdeb2a2ff76c8e1f691e1f3
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 872e7daf89f4af9d5d92ceea3ba791b24fd358e1a1f7e5d738032b2f90286b256ad544ae06a24231c290535526efaef3a772fbb81e09f991928b17521ce83563
|
7
|
+
data.tar.gz: 4a8ff939e59d6c704946618e315b17df72ae5fedaa2cdd9449652c22f4987f14458f31e15d8bbd9b63e6f0d371c85585143de1676b8e30485e528871a006a009
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,7 @@
|
|
1
|
+
# 2.0.5
|
2
|
+
- Depend on logstash-core-plugin-api instead of logstash-core, removing the need to mass update plugins on major releases of logstash
|
3
|
+
# 2.0.4
|
4
|
+
- New dependency requirements for logstash-core for the 5.0 release
|
1
5
|
## 2.0.3
|
2
6
|
- fix fieldref assignment to avoid assumption on mutable object
|
3
7
|
## 2.0.0
|
@@ -83,7 +83,7 @@
|
|
83
83
|
#
|
84
84
|
# Grok sits on top of regular expressions, so any regular expressions are valid
|
85
85
|
# in grok as well. The regular expression library is Oniguruma, and you can see
|
86
|
-
# the full supported regexp syntax https://github.com/kkos/oniguruma/blob/master/doc/RE[on the
|
86
|
+
# the full supported regexp syntax https://github.com/kkos/oniguruma/blob/master/doc/RE[on the Oniguruma
|
87
87
|
# site].
|
88
88
|
#
|
89
89
|
# ==== Custom Patterns
|
@@ -120,7 +120,7 @@
|
|
120
120
|
# [source,ruby]
|
121
121
|
# filter {
|
122
122
|
# grok {
|
123
|
-
# patterns_dir => "./patterns"
|
123
|
+
# patterns_dir => ["./patterns"]
|
124
124
|
# match => { "message" => "%{SYSLOGBASE} %{POSTFIX_QUEUEID:queue_id}: %{GREEDYDATA:syslog_message}" }
|
125
125
|
# }
|
126
126
|
# }
|
@@ -166,8 +166,8 @@
|
|
166
166
|
# Logstash ships by default with a bunch of patterns, so you don't
|
167
167
|
# necessarily need to define this yourself unless you are adding additional
|
168
168
|
# patterns. You can point to multiple pattern directories using this setting
|
169
|
-
# Note that Grok will read all files in the directory
|
170
|
-
# file (including any tilde backup files)
|
169
|
+
# Note that Grok will read all files in the directory matching the patterns_files_glob
|
170
|
+
# and assume its a pattern file (including any tilde backup files)
|
171
171
|
# [source,ruby]
|
172
172
|
# patterns_dir => ["/opt/logstash/patterns", "/opt/logstash/extra_patterns"]
|
173
173
|
#
|
@@ -180,6 +180,10 @@
|
|
180
180
|
# NUMBER \d+
|
181
181
|
config :patterns_dir, :validate => :array, :default => []
|
182
182
|
|
183
|
+
# Glob pattern, used to select the pattern files in the directories
|
184
|
+
# specified by patterns_dir
|
185
|
+
config :patterns_files_glob, :validate => :string, :default => "*"
|
186
|
+
|
183
187
|
# Break on first match. The first successful match by grok will result in the
|
184
188
|
# filter being finished. If you want grok to try all patterns (maybe you are
|
185
189
|
# parsing different things), then set this to false.
|
@@ -241,19 +245,9 @@
|
|
241
245
|
|
242
246
|
# Have @@patterns_path show first. Last-in pattern definitions win; this
|
243
247
|
# will let folks redefine built-in patterns at runtime.
|
244
|
-
@
|
245
|
-
@
|
246
|
-
|
247
|
-
if File.directory?(path)
|
248
|
-
path = File.join(path, "*")
|
249
|
-
end
|
250
|
-
|
251
|
-
Dir.glob(path).each do |file|
|
252
|
-
@logger.info? and @logger.info("Grok loading patterns from file", :path => file)
|
253
|
-
@patternfiles << file
|
254
|
-
end
|
255
|
-
end
|
256
|
-
|
248
|
+
@patternfiles += patterns_files_from_paths(@@patterns_path.to_a, "*")
|
249
|
+
@patternfiles += patterns_files_from_paths(@patterns_dir, @patterns_files_glob)
|
250
|
+
|
257
251
|
@patterns = Hash.new { |h,k| h[k] = [] }
|
258
252
|
|
259
253
|
@logger.info? and @logger.info("Match data", :match => @match)
|
@@ -352,6 +346,23 @@
|
|
352
346
|
end
|
353
347
|
end
|
354
348
|
|
349
|
+
private
|
350
|
+
def patterns_files_from_paths(paths, glob)
|
351
|
+
patternfiles = []
|
352
|
+
@logger.info? and @logger.info("Grok patterns path", :paths => paths)
|
353
|
+
paths.each do |path|
|
354
|
+
if File.directory?(path)
|
355
|
+
path = File.join(path, glob)
|
356
|
+
end
|
357
|
+
|
358
|
+
Dir.glob(path).each do |file|
|
359
|
+
@logger.info? and @logger.info("Grok loading patterns from file", :path => file)
|
360
|
+
patternfiles << file
|
361
|
+
end
|
362
|
+
end
|
363
|
+
patternfiles
|
364
|
+
end # def patterns_files_from_paths
|
365
|
+
|
355
366
|
private
|
356
367
|
def add_patterns_from_files(paths, grok)
|
357
368
|
paths.each do |path|
|
@@ -1,7 +1,7 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-grok'
|
4
|
-
s.version = '2.0.
|
4
|
+
s.version = '2.0.5'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "Parse arbitrary text and structure it."
|
7
7
|
s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
|
@@ -20,7 +20,7 @@ Gem::Specification.new do |s|
|
|
20
20
|
s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
|
21
21
|
|
22
22
|
# Gem dependencies
|
23
|
-
s.add_runtime_dependency "logstash-core", "
|
23
|
+
s.add_runtime_dependency "logstash-core-plugin-api", "~> 1.0"
|
24
24
|
|
25
25
|
s.add_runtime_dependency 'jls-grok', '~> 0.11.1'
|
26
26
|
s.add_runtime_dependency 'logstash-patterns-core'
|
data/spec/filters/grok_spec.rb
CHANGED
@@ -1,11 +1,21 @@
|
|
1
1
|
# encoding: utf-8
|
2
2
|
require "logstash/devutils/rspec/spec_helper"
|
3
3
|
|
4
|
-
|
5
|
-
|
6
|
-
#
|
7
|
-
|
8
|
-
|
4
|
+
|
5
|
+
module LogStash::Environment
|
6
|
+
# running the grok code outside a logstash package means
|
7
|
+
# LOGSTASH_HOME will not be defined, so let's set it here
|
8
|
+
# before requiring the grok filter
|
9
|
+
unless self.const_defined?(:LOGSTASH_HOME)
|
10
|
+
LOGSTASH_HOME = File.expand_path("../../../", __FILE__)
|
11
|
+
end
|
12
|
+
|
13
|
+
# also :pattern_path method must exist so we define it too
|
14
|
+
unless self.method_defined?(:pattern_path)
|
15
|
+
def pattern_path(path)
|
16
|
+
::File.join(LOGSTASH_HOME, "patterns", path)
|
17
|
+
end
|
18
|
+
end
|
9
19
|
end
|
10
20
|
|
11
21
|
require "logstash/filters/grok"
|
@@ -661,7 +671,7 @@ describe LogStash::Filters::Grok do
|
|
661
671
|
|
662
672
|
before do
|
663
673
|
FileUtils.mkdir(pattern_dir) unless has_pattern_dir?
|
664
|
-
@file = Tempfile.new('grok', pattern_dir)
|
674
|
+
@file = Tempfile.new('grok', pattern_dir)
|
665
675
|
@file.write('WORD \b[2-5]\b')
|
666
676
|
@file.close
|
667
677
|
end
|
@@ -690,8 +700,12 @@ describe LogStash::Filters::Grok do
|
|
690
700
|
|
691
701
|
before do
|
692
702
|
FileUtils.mkdir(pattern_dir) unless has_pattern_dir?
|
693
|
-
@file1 = Tempfile.new('grok', pattern_dir)
|
694
|
-
@
|
703
|
+
@file1 = Tempfile.new('grok', pattern_dir)
|
704
|
+
@file1.write('WORD \b[2-5]\b')
|
705
|
+
@file1.close
|
706
|
+
@file2 = Tempfile.new('grok', tmpdir)
|
707
|
+
@file2.write('WORD \b[0-1]\b')
|
708
|
+
@file2.close
|
695
709
|
end
|
696
710
|
|
697
711
|
let(:config) do
|
@@ -710,6 +724,36 @@ describe LogStash::Filters::Grok do
|
|
710
724
|
end
|
711
725
|
end
|
712
726
|
|
727
|
+
describe "patterns with file glob" do
|
728
|
+
require 'tmpdir'
|
729
|
+
require 'tempfile'
|
730
|
+
|
731
|
+
let(:tmpdir) { Dir.mktmpdir(nil, "/tmp") }
|
732
|
+
|
733
|
+
before do
|
734
|
+
@file3 = Tempfile.new(['grok', '.pattern'], tmpdir)
|
735
|
+
@file3.write('WORD \b[0-1]\b')
|
736
|
+
@file3.close
|
737
|
+
@file4 = Tempfile.new(['grok', '.pattern.old'], tmpdir)
|
738
|
+
@file4.write('WORD \b[2-5]\b')
|
739
|
+
@file4.close
|
740
|
+
end
|
741
|
+
|
742
|
+
let(:config) do
|
743
|
+
"filter { grok { patterns_dir => \"#{tmpdir}\" patterns_files_glob => \"*.pattern\" pattern => \"%{WORD:word}\" } }"
|
744
|
+
end
|
745
|
+
|
746
|
+
sample("message" => '0') do
|
747
|
+
insist { subject["tags"] } == nil
|
748
|
+
end
|
749
|
+
|
750
|
+
after do
|
751
|
+
@file3.unlink
|
752
|
+
@file4.unlink
|
753
|
+
FileUtils.remove_entry tmpdir
|
754
|
+
end
|
755
|
+
end
|
756
|
+
|
713
757
|
describe "grok with nil coerced value" do
|
714
758
|
config <<-CONFIG
|
715
759
|
filter {
|
metadata
CHANGED
@@ -1,77 +1,71 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-grok
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 2.0.
|
4
|
+
version: 2.0.5
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2016-03-24 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
|
-
name: logstash-core
|
15
|
-
version_requirements: !ruby/object:Gem::Requirement
|
16
|
-
requirements:
|
17
|
-
- - '>='
|
18
|
-
- !ruby/object:Gem::Version
|
19
|
-
version: 2.0.0.beta2
|
20
|
-
- - <
|
21
|
-
- !ruby/object:Gem::Version
|
22
|
-
version: 3.0.0
|
23
14
|
requirement: !ruby/object:Gem::Requirement
|
24
15
|
requirements:
|
25
|
-
- -
|
26
|
-
- !ruby/object:Gem::Version
|
27
|
-
version: 2.0.0.beta2
|
28
|
-
- - <
|
16
|
+
- - "~>"
|
29
17
|
- !ruby/object:Gem::Version
|
30
|
-
version:
|
18
|
+
version: '1.0'
|
19
|
+
name: logstash-core-plugin-api
|
31
20
|
prerelease: false
|
32
21
|
type: :runtime
|
33
|
-
- !ruby/object:Gem::Dependency
|
34
|
-
name: jls-grok
|
35
22
|
version_requirements: !ruby/object:Gem::Requirement
|
36
23
|
requirements:
|
37
|
-
- - ~>
|
24
|
+
- - "~>"
|
38
25
|
- !ruby/object:Gem::Version
|
39
|
-
version: 0
|
26
|
+
version: '1.0'
|
27
|
+
- !ruby/object:Gem::Dependency
|
40
28
|
requirement: !ruby/object:Gem::Requirement
|
41
29
|
requirements:
|
42
|
-
- - ~>
|
30
|
+
- - "~>"
|
43
31
|
- !ruby/object:Gem::Version
|
44
32
|
version: 0.11.1
|
33
|
+
name: jls-grok
|
45
34
|
prerelease: false
|
46
35
|
type: :runtime
|
47
|
-
- !ruby/object:Gem::Dependency
|
48
|
-
name: logstash-patterns-core
|
49
36
|
version_requirements: !ruby/object:Gem::Requirement
|
50
37
|
requirements:
|
51
|
-
- -
|
38
|
+
- - "~>"
|
52
39
|
- !ruby/object:Gem::Version
|
53
|
-
version:
|
40
|
+
version: 0.11.1
|
41
|
+
- !ruby/object:Gem::Dependency
|
54
42
|
requirement: !ruby/object:Gem::Requirement
|
55
43
|
requirements:
|
56
|
-
- -
|
44
|
+
- - ">="
|
57
45
|
- !ruby/object:Gem::Version
|
58
46
|
version: '0'
|
47
|
+
name: logstash-patterns-core
|
59
48
|
prerelease: false
|
60
49
|
type: :runtime
|
61
|
-
- !ruby/object:Gem::Dependency
|
62
|
-
name: logstash-devutils
|
63
50
|
version_requirements: !ruby/object:Gem::Requirement
|
64
51
|
requirements:
|
65
|
-
- -
|
52
|
+
- - ">="
|
66
53
|
- !ruby/object:Gem::Version
|
67
54
|
version: '0'
|
55
|
+
- !ruby/object:Gem::Dependency
|
68
56
|
requirement: !ruby/object:Gem::Requirement
|
69
57
|
requirements:
|
70
|
-
- -
|
58
|
+
- - ">="
|
71
59
|
- !ruby/object:Gem::Version
|
72
60
|
version: '0'
|
61
|
+
name: logstash-devutils
|
73
62
|
prerelease: false
|
74
63
|
type: :development
|
64
|
+
version_requirements: !ruby/object:Gem::Requirement
|
65
|
+
requirements:
|
66
|
+
- - ">="
|
67
|
+
- !ruby/object:Gem::Version
|
68
|
+
version: '0'
|
75
69
|
description: This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program
|
76
70
|
email: info@elastic.co
|
77
71
|
executables: []
|
@@ -99,12 +93,12 @@ require_paths:
|
|
99
93
|
- lib
|
100
94
|
required_ruby_version: !ruby/object:Gem::Requirement
|
101
95
|
requirements:
|
102
|
-
- -
|
96
|
+
- - ">="
|
103
97
|
- !ruby/object:Gem::Version
|
104
98
|
version: '0'
|
105
99
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
106
100
|
requirements:
|
107
|
-
- -
|
101
|
+
- - ">="
|
108
102
|
- !ruby/object:Gem::Version
|
109
103
|
version: '0'
|
110
104
|
requirements: []
|