logstash-filter-grok 4.4.0 → 4.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 87eff1d28b6fd87d466b877482c6a81f7c831085fa412648e99b06b01f63bdb7
-  data.tar.gz: c97a71386c92e197718de56e99d7d93da9be6c9106b268d87f0fce7679aa320e
+  metadata.gz: 7da420422b6fab57d3744663967c3074c61527b7f3fdb21734743f86f7204cbc
+  data.tar.gz: 222fc8470f7baa66579e9d58caa6346e6ee14aa27119ba0fd4fbabe6c88497a7
 SHA512:
-  metadata.gz: 3542aeedd78021a4d27060a8cb28f2f4818d0b898f18ad1bc756f9fda7ca80bf07876bbff07d78d7390388c0cab6a6a939fdaea66d81d02f10a7f896c77fc461
-  data.tar.gz: 344c2f04142ae37a4cf1b5fafca6d3c592b80eac15829a5bd342c550b40b3204acaf2e0c3e8ffd2cf0a310a269c7caa8492c3ca4b1178cd0d505cbc9cb6c6c7a
+  metadata.gz: 8edfd6601703121eee96a189a3bb67153887779c4505361baf54cf12a01cb28391af8ed7a8b59bdfb873f6d9046da262a5ed22d18376379f9d87feab748a5e88
+  data.tar.gz: 2269f42b002e42637579d803c12fdb5a238c8904e6a36703e1c53a6e2c656b3407f8150567f355b84106613d8a1d410b665393c52db67547ca750ee4778e3e87

data/CHANGELOG.md

@@ -1,7 +1,10 @@
+## 4.4.1
+ - Added preview of ECS v8 support using existing ECS v1 implementation [#175](https://github.com/logstash-plugins/logstash-filter-grok/pull/175)
+
 ## 4.4.0
  - Feat: ECS compatibility support [#162](https://github.com/logstash-plugins/logstash-filter-grok/pull/162)
  
-   The filter supports using (built-in) patterns definition that are fully Elactic Common Schema compliant.
+   The filter supports using built-in pattern definitions that are fully Elastic Common Schema (ECS) compliant.
 
 ## 4.3.0
  - Added: added target support [#156](https://github.com/logstash-plugins/logstash-filter-grok/pull/156)

data/docs/index.asciidoc

@@ -235,7 +235,7 @@ parsing different things), then set this to false.
 * Value type is <<string,string>>
 * Supported values are:
 ** `disabled`: the plugin will load legacy (built-in) pattern definitions
-** `v1`: all patterns provided by the plugin will use ECS compliant captures
+** `v1`,`v8`: all patterns provided by the plugin will use ECS compliant captures
 * Default value depends on which version of Logstash is running:
 ** When Logstash provides a `pipeline.ecs_compatibility` setting, its value is used as the default
 ** Otherwise, the default value is `disabled`.
@@ -313,6 +313,17 @@ overwrite the `message` field with part of the match like so:
 In this case, a line like `May 29 16:37:11 sadness logger: hello world`
 will be parsed and `hello world` will overwrite the original message.
 
+If you are using a field reference in `overwrite`, you must use the field 
+reference in the pattern. Example:
+[source,ruby]
+    filter {
+      grok {
+        match => { "somefield" => "%{NUMBER} %{GREEDYDATA:[nested][field][test]}" }
+        overwrite => [ "[nested][field][test]" ]
+      }
+    }
+
+
 [id="plugins-{type}s-{plugin}-pattern_definitions"]
 ===== `pattern_definitions` 
 

data/lib/logstash/filters/grok.rb

@@ -332,6 +332,9 @@
         patterns_path << LogStash::Patterns::Core.path # :legacy
       when :v1
         patterns_path << LogStash::Patterns::Core.path('ecs-v1')
+      when :v8
+        @logger.warn("ECS v8 support is a preview of the unreleased ECS v8, and uses the v1 patterns. When Version 8 of the Elastic Common Schema becomes available, this plugin will need to be updated")
+        patterns_path << LogStash::Patterns::Core.path('ecs-v1')
       else
         fail(NotImplementedError, "ECS #{ecs_compatibility} is not supported by this plugin.")
       end

data/logstash-filter-grok.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name            = 'logstash-filter-grok'
-  s.version         = '4.4.0'
+  s.version         = '4.4.1'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Parses unstructured event data into fields"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

data/spec/filters/grok_spec.rb

@@ -38,13 +38,15 @@ describe LogStash::Filters::Grok do
       expect( event.get("pid") ).to eql "1713"
     end
 
-    context 'in ecs mode' do
-      let(:config) { super.merge('ecs_compatibility' => 'v1') }
+    %w(v1 v8).each do |ecs_mode|
+      context "in ecs mode #{ecs_mode}" do
+        let(:config) { super().merge('ecs_compatibility' => ecs_mode) }
 
-      it "matches pattern" do
-        expect( event.get("host") ).to eql "hostname"=>"evita"
-        expect( event.get("process") ).to eql "name"=>"postfix/smtpd", "pid"=>1713
-        expect( event.get("message") ).to eql "connect from camomile.cloud9.net[168.100.1.3]"
+        it "matches pattern" do
+          expect( event.get("host") ).to eql "hostname"=>"evita"
+          expect( event.get("process") ).to eql "name"=>"postfix/smtpd", "pid"=>1713
+          expect( event.get("message") ).to eql "connect from camomile.cloud9.net[168.100.1.3]"
+        end
       end
     end
 
@@ -701,7 +703,7 @@ describe LogStash::Filters::Grok do
       expect( LogStash::Json.dump(event.get('username')) ).to eql "\"testuser\""
 
       expect( event.to_json ).to match %r|"src_ip":"1.1.1.1"|
-      expect( event.to_json ).to match %r|"@timestamp":"20\d\d-\d\d-\d\dT\d\d:\d\d:\d\d\.\d\d\dZ"|
+      expect( event.to_json ).to match %r|"@timestamp":"#{Regexp.escape(event.get('@timestamp').to_s)}"|
       expect( event.to_json ).to match %r|"port":"22"|
       expect( event.to_json ).to match %r|"@version":"1"|
       expect( event.to_json ).to match %r|"username"|i
@@ -769,6 +771,26 @@ describe LogStash::Filters::Grok do
   end
 end
 
+describe LogStash::Filters::Grok do
+
+  subject(:grok_filter) { described_class.new(config) }
+  let(:config) { {} }
+
+  context 'when initialized with `ecs_compatibility => v8`' do
+    let(:config) { super().merge("ecs_compatibility" => "v8", "match" => ["message", "%{SYSLOGLINE}"]) }
+    context '#register' do
+      let(:logger_stub) { double('Logger').as_null_object }
+      before(:each) { allow_any_instance_of(described_class).to receive(:logger).and_return(logger_stub)}
+
+      it 'logs a helpful warning about the unreleased v8' do
+        grok_filter.register
+
+        expect(logger_stub).to have_received(:warn).with(a_string_including "preview of the unreleased ECS v8")
+      end
+    end
+  end
+end
+
 describe LogStash::Filters::Grok do
   describe "(LEGACY)" do
     describe "patterns in the 'patterns/' dir override core patterns" do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-grok
 version: !ruby/object:Gem::Version
-  version: 4.4.0
+  version: 4.4.1
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-02-18 00:00:00.000000000 Z
+date: 2021-11-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -161,8 +161,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project:
-rubygems_version: 2.6.13
+rubygems_version: 3.1.6
 signing_key:
 specification_version: 4
 summary: Parses unstructured event data into fields