logstash-filter-grok 4.0.4 → 4.4.0

data/spec/spec_helper.rb

@@ -0,0 +1,19 @@
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"
+require "stud/temporary"
+
+module LogStash::Environment
+  # running the grok code outside a logstash package means
+  # LOGSTASH_HOME will not be defined, so let's set it here
+  # before requiring the grok filter
+  unless self.const_defined?(:LOGSTASH_HOME)
+    LOGSTASH_HOME = File.expand_path("../../../", __FILE__)
+  end
+
+  # also :pattern_path method must exist so we define it too
+  unless self.method_defined?(:pattern_path)
+    def pattern_path(path)
+      ::File.join(LOGSTASH_HOME, "patterns", path)
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-grok
 version: !ruby/object:Gem::Version
-  version: 4.0.4
+  version: 4.4.0
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-10-19 00:00:00.000000000 Z
+date: 2021-02-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -44,6 +44,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 5.6.0
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  name: logstash-mixin-ecs_compatibility_support
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
     requirements:
@@ -77,7 +91,10 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 4.3.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5'
   name: logstash-patterns-core
   prerelease: false
   type: :runtime
@@ -85,21 +102,24 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 4.3.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5'
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.3.6
+        version: '0'
   name: logstash-devutils
   prerelease: false
   type: :development
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.3.6
+        version: '0'
 description: This gem is a Logstash plugin required to be installed on top of the
   Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
   gem is not a stand-alone program
@@ -116,10 +136,10 @@ files:
 - README.md
 - docs/index.asciidoc
 - lib/logstash/filters/grok.rb
-- lib/logstash/filters/grok/timeout_enforcer.rb
-- lib/logstash/filters/grok/timeout_exception.rb
 - logstash-filter-grok.gemspec
+- spec/filters/grok_performance_spec.rb
 - spec/filters/grok_spec.rb
+- spec/spec_helper.rb
 homepage: http://www.elastic.co/guide/en/logstash/current/index.html
 licenses:
 - Apache License (2.0)
@@ -147,4 +167,6 @@ signing_key:
 specification_version: 4
 summary: Parses unstructured event data into fields
 test_files:
+- spec/filters/grok_performance_spec.rb
 - spec/filters/grok_spec.rb
+- spec/spec_helper.rb

data/lib/logstash/filters/grok/timeout_enforcer.rb

@@ -1,72 +0,0 @@
-class LogStash::Filters::Grok::TimeoutEnforcer
-  def initialize(logger, timeout_nanos)
-    @logger = logger
-    @running = java.util.concurrent.atomic.AtomicBoolean.new(false)
-    @timeout_nanos = timeout_nanos
-
-    # Stores running matches with their start time, this is used to cancel long running matches
-    # Is a map of Thread => start_time
-    @threads_to_start_time = java.util.concurrent.ConcurrentHashMap.new
-  end
-
-  def running
-    @running.get()
-  end
-
-  def grok_till_timeout(grok, field, value)
-    begin
-      thread = java.lang.Thread.currentThread()
-      @threads_to_start_time.put(thread, java.lang.System.nanoTime)
-      grok.execute(value)
-    rescue InterruptedRegexpError, java.lang.InterruptedException => e
-      raise ::LogStash::Filters::Grok::TimeoutException.new(grok, field, value)
-    ensure
-      # If the regexp finished, but interrupt was called after, we'll want to
-      # clear the interrupted status anyway
-      @threads_to_start_time.remove(thread)
-      thread.interrupted
-    end
-  end
-
-  def start!
-    @running.set(true)
-    @timer_thread = Thread.new do
-      while @running.get()
-        begin
-          cancel_timed_out!
-        rescue Exception => e
-          @logger.error("Error while attempting to check/cancel excessively long grok patterns",
-                        :message => e.message,
-                        :class => e.class.name,
-                        :backtrace => e.backtrace
-                       )
-        end
-        sleep 0.25
-      end
-    end
-  end
-
-  def stop!
-    @running.set(false)
-    # Check for the thread mostly for a fast start/shutdown scenario
-    @timer_thread.join if @timer_thread
-  end
-
-  private
-
-  def cancel_timed_out!
-    now = java.lang.System.nanoTime # save ourselves some nanotime calls
-    @threads_to_start_time.keySet.each do |thread|
-      # Use compute to lock this value
-      @threads_to_start_time.computeIfPresent(thread) do |thread, start_time|
-        if start_time < now && now - start_time > @timeout_nanos
-          thread.interrupt
-          nil # Delete the key
-        else
-          start_time # preserve the key
-        end
-      end
-    end
-  end
-
-end

data/lib/logstash/filters/grok/timeout_exception.rb

@@ -1,21 +0,0 @@
-class LogStash::Filters::Grok::TimeoutException < Exception
-  attr_reader :grok, :field, :value
-  
-  def initialize(grok=nil, field=nil, value=nil)
-    @field = field
-    @value = value
-    @grok = grok
-  end
-
-  def message
-    "Timeout executing grok '#{@grok.pattern}' against field '#{field}' with value '#{trunc_value}'!"
-  end
-
-  def trunc_value
-    if value.size <= 255 # If no more than 255 chars
-      value
-    else
-      "Value too large to output (#{value.bytesize} bytes)! First 255 chars are: #{value[0..255]}"
-    end
-  end
-end