logstash-filter-grok 2.0.5 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4f63a7bd21e2ebab75a4cc94f26731323f8912f7
-  data.tar.gz: a2ae27830a99ac4b0bdeb2a2ff76c8e1f691e1f3
+  metadata.gz: 6ed17e8438274c966ed007c49208b42683ce7e95
+  data.tar.gz: 98c0b8ff214122ef7e1c90d7bb527d86e44e09aa
 SHA512:
-  metadata.gz: 872e7daf89f4af9d5d92ceea3ba791b24fd358e1a1f7e5d738032b2f90286b256ad544ae06a24231c290535526efaef3a772fbb81e09f991928b17521ce83563
-  data.tar.gz: 4a8ff939e59d6c704946618e315b17df72ae5fedaa2cdd9449652c22f4987f14458f31e15d8bbd9b63e6f0d371c85585143de1676b8e30485e528871a006a009
+  metadata.gz: 2e36982282ce0ab9ba59b9c59a7b659897f2d87ad67f059d167dbc3666b1298c3584c22737923b27e04287e6854cd691654281dde12aebb486c333f8e2798d7a
+  data.tar.gz: 41a23c2079664a3a1d6c7849fd05e4255bc2ec462eeb500cf3cea8a2cface478be2ed48eb9070f17083b2e080eea221555cbe53d7cf848ad57ba49b971d78286

data/CHANGELOG.md

@@ -1,3 +1,5 @@
+## 3.0.0
+  - Update the plugin to the version 2.0 of the plugin api, this change is required for Logstash 5.0 compatibility. See https://github.com/elastic/logstash/issues/5141
 # 2.0.5
   - Depend on logstash-core-plugin-api instead of logstash-core, removing the need to mass update plugins on major releases of logstash
 # 2.0.4

data/Gemfile

@@ -1,2 +1,4 @@
 source 'https://rubygems.org'
-gemspec
+
+# Specify your gem's dependencies in logstash-mass_effect.gemspec
+gemspec

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2012–2015 Elasticsearch <http://www.elastic.co>
+Copyright (c) 2012–2016 Elasticsearch <http://www.elastic.co>
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

data/README.md

@@ -1,7 +1,6 @@
 # Logstash Plugin
 
-[![Build
-Status](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Filters/job/logstash-plugin-filter-grok-unit/badge/icon)](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Filters/job/logstash-plugin-filter-grok-unit/)
+[![Travis Build Status](https://travis-ci.org/logstash-plugins/logstash-filter-grok.svg)](https://travis-ci.org/logstash-plugins/logstash-filter-grok)
 
 This is a plugin for [Logstash](https://github.com/elastic/logstash).
 
@@ -56,7 +55,12 @@ gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
 ```
 - Install plugin
 ```sh
+# Logstash 2.3 and higher
+bin/logstash-plugin install --no-verify
+
+# Prior to Logstash 2.3
 bin/plugin install --no-verify
+
 ```
 - Run Logstash with your plugin
 ```sh
@@ -74,7 +78,12 @@ gem build logstash-filter-awesome.gemspec
 ```
 - Install the plugin from the Logstash home
 ```sh
-bin/plugin install /your/local/plugin/logstash-filter-awesome.gem
+# Logstash 2.3 and higher
+bin/logstash-plugin install --no-verify
+
+# Prior to Logstash 2.3
+bin/plugin install --no-verify
+
 ```
 - Start Logstash and proceed to test the plugin
 

data/lib/logstash/filters/grok.rb

@@ -247,7 +247,7 @@
       # will let folks redefine built-in patterns at runtime.
       @patternfiles += patterns_files_from_paths(@@patterns_path.to_a, "*")
       @patternfiles += patterns_files_from_paths(@patterns_dir, @patterns_files_glob)
-  
+
       @patterns = Hash.new { |h,k| h[k] = [] }
 
       @logger.info? and @logger.info("Match data", :match => @match)
@@ -269,8 +269,6 @@
 
     public
     def filter(event)
-
-
       matched = false
       done = false
 
@@ -294,7 +292,7 @@
 
     private
     def match(groks, field, event)
-      input = event[field]
+      input = event.get(field)
       if input.is_a?(Array)
         success = false
         input.each do |input|
@@ -327,21 +325,21 @@
       return if (value.nil? || (value.is_a?(String) && value.empty?)) unless @keep_empty_captures
 
       if @overwrite.include?(field)
-        event[field] = value
+        event.set(field, value)
       else
-        v = event[field]
+        v = event.get(field)
         if v.nil?
-          event[field] = value
+          event.set(field, value)
         elsif v.is_a?(Array)
           # do not replace the code below with:
           #   event[field] << value
           # this assumes implementation specific feature of returning a mutable object
           # from a field ref which should not be assumed and will change in the future.
           v << value
-          event[field] = v
+          event.set(field, v)
         elsif v.is_a?(String)
           # Promote to array since we aren't overwriting.
-          event[field] = [v, value]
+          event.set(field, [v, value])
         end
       end
     end

data/logstash-filter-grok.gemspec

@@ -1,10 +1,10 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-grok'
-  s.version         = '2.0.5'
+  s.version         = '3.0.0'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Parse arbitrary text and structure it."
-  s.description     = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
+  s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
   s.authors         = ["Elastic"]
   s.email           = 'info@elastic.co'
   s.homepage        = "http://www.elastic.co/guide/en/logstash/current/index.html"
@@ -20,7 +20,7 @@ Gem::Specification.new do |s|
   s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
 
   # Gem dependencies
-  s.add_runtime_dependency "logstash-core-plugin-api", "~> 1.0"
+  s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
 
   s.add_runtime_dependency 'jls-grok', '~> 0.11.1'
   s.add_runtime_dependency 'logstash-patterns-core'

data/spec/filters/grok_spec.rb

@@ -36,12 +36,12 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample "Mar 16 00:01:25 evita postfix/smtpd[1713]: connect from camomile.cloud9.net[168.100.1.3]" do
-      insist { subject["tags"] }.nil?
-      insist { subject["logsource"] } == "evita"
-      insist { subject["timestamp"] } == "Mar 16 00:01:25"
-      insist { subject["message"] } == "connect from camomile.cloud9.net[168.100.1.3]"
-      insist { subject["program"] } == "postfix/smtpd"
-      insist { subject["pid"] } == "1713"
+      insist { subject.get("tags") }.nil?
+      insist { subject.get("logsource") } == "evita"
+      insist { subject.get("timestamp") } == "Mar 16 00:01:25"
+      insist { subject.get("message") } == "connect from camomile.cloud9.net[168.100.1.3]"
+      insist { subject.get("program") } == "postfix/smtpd"
+      insist { subject.get("pid") } == "1713"
     end
   end
 
@@ -58,120 +58,120 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug 4123 - [id1 foo=\"bar\"][id2 baz=\"something\"] Hello, syslog." do
-      insist { subject["tags"] }.nil?
-      insist { subject["syslog5424_pri"] } == "191"
-      insist { subject["syslog5424_ver"] } == "1"
-      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
-      insist { subject["syslog5424_host"] } == "paxton.local"
-      insist { subject["syslog5424_app"] } == "grokdebug"
-      insist { subject["syslog5424_proc"] } == "4123"
-      insist { subject["syslog5424_msgid"] } == nil
-      insist { subject["syslog5424_sd"] } == "[id1 foo=\"bar\"][id2 baz=\"something\"]"
-      insist { subject["syslog5424_msg"] } == "Hello, syslog."
+      insist { subject.get("tags") }.nil?
+      insist { subject.get("syslog5424_pri") } == "191"
+      insist { subject.get("syslog5424_ver") } == "1"
+      insist { subject.get("syslog5424_ts") } == "2009-06-30T18:30:00+02:00"
+      insist { subject.get("syslog5424_host") } == "paxton.local"
+      insist { subject.get("syslog5424_app") } == "grokdebug"
+      insist { subject.get("syslog5424_proc") } == "4123"
+      insist { subject.get("syslog5424_msgid") } == nil
+      insist { subject.get("syslog5424_sd") } == "[id1 foo=\"bar\"][id2 baz=\"something\"]"
+      insist { subject.get("syslog5424_msg") } == "Hello, syslog."
     end
 
     sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug - - [id1 foo=\"bar\"] No process ID." do
-      insist { subject["tags"] }.nil?
-      insist { subject["syslog5424_pri"] } == "191"
-      insist { subject["syslog5424_ver"] } == "1"
-      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
-      insist { subject["syslog5424_host"] } == "paxton.local"
-      insist { subject["syslog5424_app"] } == "grokdebug"
-      insist { subject["syslog5424_proc"] } == nil
-      insist { subject["syslog5424_msgid"] } == nil
-      insist { subject["syslog5424_sd"] } == "[id1 foo=\"bar\"]"
-      insist { subject["syslog5424_msg"] } == "No process ID."
+      insist { subject.get("tags") }.nil?
+      insist { subject.get("syslog5424_pri") } == "191"
+      insist { subject.get("syslog5424_ver") } == "1"
+      insist { subject.get("syslog5424_ts") } == "2009-06-30T18:30:00+02:00"
+      insist { subject.get("syslog5424_host") } == "paxton.local"
+      insist { subject.get("syslog5424_app") } == "grokdebug"
+      insist { subject.get("syslog5424_proc") } == nil
+      insist { subject.get("syslog5424_msgid") } == nil
+      insist { subject.get("syslog5424_sd") } == "[id1 foo=\"bar\"]"
+      insist { subject.get("syslog5424_msg") } == "No process ID."
     end
 
     sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug 4123 - - No structured data." do
-      insist { subject["tags"] }.nil?
-      insist { subject["syslog5424_pri"] } == "191"
-      insist { subject["syslog5424_ver"] } == "1"
-      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
-      insist { subject["syslog5424_host"] } == "paxton.local"
-      insist { subject["syslog5424_app"] } == "grokdebug"
-      insist { subject["syslog5424_proc"] } == "4123"
-      insist { subject["syslog5424_msgid"] } == nil
-      insist { subject["syslog5424_sd"] } == nil
-      insist { subject["syslog5424_msg"] } == "No structured data."
+      insist { subject.get("tags") }.nil?
+      insist { subject.get("syslog5424_pri") } == "191"
+      insist { subject.get("syslog5424_ver") } == "1"
+      insist { subject.get("syslog5424_ts") } == "2009-06-30T18:30:00+02:00"
+      insist { subject.get("syslog5424_host") } == "paxton.local"
+      insist { subject.get("syslog5424_app") } == "grokdebug"
+      insist { subject.get("syslog5424_proc") } == "4123"
+      insist { subject.get("syslog5424_msgid") } == nil
+      insist { subject.get("syslog5424_sd") } == nil
+      insist { subject.get("syslog5424_msg") } == "No structured data."
     end
 
     sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug - - - No PID or SD." do
-      insist { subject["tags"] }.nil?
-      insist { subject["syslog5424_pri"] } == "191"
-      insist { subject["syslog5424_ver"] } == "1"
-      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
-      insist { subject["syslog5424_host"] } == "paxton.local"
-      insist { subject["syslog5424_app"] } == "grokdebug"
-      insist { subject["syslog5424_proc"] } == nil
-      insist { subject["syslog5424_msgid"] } == nil
-      insist { subject["syslog5424_sd"] } == nil
-      insist { subject["syslog5424_msg"] } == "No PID or SD."
+      insist { subject.get("tags") }.nil?
+      insist { subject.get("syslog5424_pri") } == "191"
+      insist { subject.get("syslog5424_ver") } == "1"
+      insist { subject.get("syslog5424_ts") } == "2009-06-30T18:30:00+02:00"
+      insist { subject.get("syslog5424_host") } == "paxton.local"
+      insist { subject.get("syslog5424_app") } == "grokdebug"
+      insist { subject.get("syslog5424_proc") } == nil
+      insist { subject.get("syslog5424_msgid") } == nil
+      insist { subject.get("syslog5424_sd") } == nil
+      insist { subject.get("syslog5424_msg") } == "No PID or SD."
     end
 
     sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug 4123 -  Missing structured data." do
-      insist { subject["tags"] }.nil?
-      insist { subject["syslog5424_pri"] } == "191"
-      insist { subject["syslog5424_ver"] } == "1"
-      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
-      insist { subject["syslog5424_host"] } == "paxton.local"
-      insist { subject["syslog5424_app"] } == "grokdebug"
-      insist { subject["syslog5424_proc"] } == "4123"
-      insist { subject["syslog5424_msgid"] } == nil
-      insist { subject["syslog5424_sd"] } == nil
-      insist { subject["syslog5424_msg"] } == "Missing structured data."
+      insist { subject.get("tags") }.nil?
+      insist { subject.get("syslog5424_pri") } == "191"
+      insist { subject.get("syslog5424_ver") } == "1"
+      insist { subject.get("syslog5424_ts") } == "2009-06-30T18:30:00+02:00"
+      insist { subject.get("syslog5424_host") } == "paxton.local"
+      insist { subject.get("syslog5424_app") } == "grokdebug"
+      insist { subject.get("syslog5424_proc") } == "4123"
+      insist { subject.get("syslog5424_msgid") } == nil
+      insist { subject.get("syslog5424_sd") } == nil
+      insist { subject.get("syslog5424_msg") } == "Missing structured data."
     end
 
     sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug  4123 - - Additional spaces." do
-      insist { subject["tags"] }.nil?
-      insist { subject["syslog5424_pri"] } == "191"
-      insist { subject["syslog5424_ver"] } == "1"
-      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
-      insist { subject["syslog5424_host"] } == "paxton.local"
-      insist { subject["syslog5424_app"] } == "grokdebug"
-      insist { subject["syslog5424_proc"] } == "4123"
-      insist { subject["syslog5424_msgid"] } == nil
-      insist { subject["syslog5424_sd"] } == nil
-      insist { subject["syslog5424_msg"] } == "Additional spaces."
+      insist { subject.get("tags") }.nil?
+      insist { subject.get("syslog5424_pri") } == "191"
+      insist { subject.get("syslog5424_ver") } == "1"
+      insist { subject.get("syslog5424_ts") } == "2009-06-30T18:30:00+02:00"
+      insist { subject.get("syslog5424_host") } == "paxton.local"
+      insist { subject.get("syslog5424_app") } == "grokdebug"
+      insist { subject.get("syslog5424_proc") } == "4123"
+      insist { subject.get("syslog5424_msgid") } == nil
+      insist { subject.get("syslog5424_sd") } == nil
+      insist { subject.get("syslog5424_msg") } == "Additional spaces."
     end
 
     sample "<191>1 2009-06-30T18:30:00+02:00 paxton.local grokdebug  4123 -  Additional spaces and missing SD." do
-      insist { subject["tags"] }.nil?
-      insist { subject["syslog5424_pri"] } == "191"
-      insist { subject["syslog5424_ver"] } == "1"
-      insist { subject["syslog5424_ts"] } == "2009-06-30T18:30:00+02:00"
-      insist { subject["syslog5424_host"] } == "paxton.local"
-      insist { subject["syslog5424_app"] } == "grokdebug"
-      insist { subject["syslog5424_proc"] } == "4123"
-      insist { subject["syslog5424_msgid"] } == nil
-      insist { subject["syslog5424_sd"] } == nil
-      insist { subject["syslog5424_msg"] } == "Additional spaces and missing SD."
+      insist { subject.get("tags") }.nil?
+      insist { subject.get("syslog5424_pri") } == "191"
+      insist { subject.get("syslog5424_ver") } == "1"
+      insist { subject.get("syslog5424_ts") } == "2009-06-30T18:30:00+02:00"
+      insist { subject.get("syslog5424_host") } == "paxton.local"
+      insist { subject.get("syslog5424_app") } == "grokdebug"
+      insist { subject.get("syslog5424_proc") } == "4123"
+      insist { subject.get("syslog5424_msgid") } == nil
+      insist { subject.get("syslog5424_sd") } == nil
+      insist { subject.get("syslog5424_msg") } == "Additional spaces and missing SD."
     end
 
     sample "<30>1 2014-04-04T16:44:07+02:00 osctrl01 dnsmasq-dhcp 8048 - -  Appname contains a dash" do
-      insist { subject["tags"] }.nil?
-      insist { subject["syslog5424_pri"] } == "30"
-      insist { subject["syslog5424_ver"] } == "1"
-      insist { subject["syslog5424_ts"] } == "2014-04-04T16:44:07+02:00"
-      insist { subject["syslog5424_host"] } == "osctrl01"
-      insist { subject["syslog5424_app"] } == "dnsmasq-dhcp"
-      insist { subject["syslog5424_proc"] } == "8048"
-      insist { subject["syslog5424_msgid"] } == nil
-      insist { subject["syslog5424_sd"] } == nil
-      insist { subject["syslog5424_msg"] } == "Appname contains a dash"
+      insist { subject.get("tags") }.nil?
+      insist { subject.get("syslog5424_pri") } == "30"
+      insist { subject.get("syslog5424_ver") } == "1"
+      insist { subject.get("syslog5424_ts") } == "2014-04-04T16:44:07+02:00"
+      insist { subject.get("syslog5424_host") } == "osctrl01"
+      insist { subject.get("syslog5424_app") } == "dnsmasq-dhcp"
+      insist { subject.get("syslog5424_proc") } == "8048"
+      insist { subject.get("syslog5424_msgid") } == nil
+      insist { subject.get("syslog5424_sd") } == nil
+      insist { subject.get("syslog5424_msg") } == "Appname contains a dash"
     end
 
     sample "<30>1 2014-04-04T16:44:07+02:00 osctrl01 - 8048 - -  Appname is nil" do
-      insist { subject["tags"] }.nil?
-      insist { subject["syslog5424_pri"] } == "30"
-      insist { subject["syslog5424_ver"] } == "1"
-      insist { subject["syslog5424_ts"] } == "2014-04-04T16:44:07+02:00"
-      insist { subject["syslog5424_host"] } == "osctrl01"
-      insist { subject["syslog5424_app"] } == nil
-      insist { subject["syslog5424_proc"] } == "8048"
-      insist { subject["syslog5424_msgid"] } == nil
-      insist { subject["syslog5424_sd"] } == nil
-      insist { subject["syslog5424_msg"] } == "Appname is nil"
+      insist { subject.get("tags") }.nil?
+      insist { subject.get("syslog5424_pri") } == "30"
+      insist { subject.get("syslog5424_ver") } == "1"
+      insist { subject.get("syslog5424_ts") } == "2014-04-04T16:44:07+02:00"
+      insist { subject.get("syslog5424_host") } == "osctrl01"
+      insist { subject.get("syslog5424_app") } == nil
+      insist { subject.get("syslog5424_proc") } == "8048"
+      insist { subject.get("syslog5424_msgid") } == nil
+      insist { subject.get("syslog5424_sd") } == nil
+      insist { subject.get("syslog5424_msg") } == "Appname is nil"
     end
   end
 
@@ -186,7 +186,7 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample("message" => [ "hello 12345", "world 23456" ]) do
-      insist { subject["NUMBER"] } == [ "12345", "23456" ]
+      insist { subject.get("NUMBER") } == [ "12345", "23456" ]
     end
   end
 
@@ -201,10 +201,10 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample "400 454.33" do
-      insist { subject["foo"] } == 400
-      insist { subject["foo"] }.is_a?(Fixnum)
-      insist { subject["bar"] } == 454.33
-      insist { subject["bar"] }.is_a?(Float)
+      insist { subject.get("foo") } == 400
+      insist { subject.get("foo") }.is_a?(Fixnum)
+      insist { subject.get("bar") } == 454.33
+      insist { subject.get("bar") }.is_a?(Float)
     end
   end
 
@@ -220,7 +220,7 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample "hello 1234" do
-      insist { subject["FIZZLE"] } == "1234"
+      insist { subject.get("FIZZLE") } == "1234"
     end
   end
 
@@ -237,8 +237,8 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample("message" => "hello world", "examplefield" => "12345") do
-      insist { subject["examplefield"] } == "12345"
-      insist { subject["word"] } == "hello"
+      insist { subject.get("examplefield") } == "12345"
+      insist { subject.get("word") } == "hello"
     end
   end
 
@@ -254,12 +254,12 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample "matchme 1234" do
-      insist { subject["tags"] }.nil?
-      insist { subject["new_field"] } == "1234"
+      insist { subject.get("tags") }.nil?
+      insist { subject.get("new_field") } == "1234"
     end
 
     sample "this will not be matched" do
-      insist { subject["tags"] }.include?("_grokparsefailure")
+      insist { subject.get("tags") }.include?("_grokparsefailure")
       reject { subject }.include?("new_field")
     end
   end
@@ -275,7 +275,7 @@ describe LogStash::Filters::Grok do
       CONFIG
 
       sample "1=test" do
-        insist { subject["tags"] }.nil?
+        insist { subject.get("tags") }.nil?
         insist { subject }.include?("foo1")
 
         # Since 'foo2' was not captured, it must not be present in the event.
@@ -294,7 +294,7 @@ describe LogStash::Filters::Grok do
       CONFIG
 
       sample "1=test" do
-        insist { subject["tags"] }.nil?
+        insist { subject.get("tags") }.nil?
         # use .to_hash for this test, for now, because right now
         # the Event.include? returns false for missing fields as well
         # as for fields with nil values.
@@ -317,9 +317,9 @@ describe LogStash::Filters::Grok do
 
     sample "Hello World, yo!" do
       insist { subject }.include?("WORD")
-      insist { subject["WORD"] } == "World"
+      insist { subject.get("WORD") } == "World"
       insist { subject }.include?("foo")
-      insist { subject["foo"] } == "yo"
+      insist { subject.get("foo") } == "yo"
     end
   end
 
@@ -334,8 +334,8 @@ describe LogStash::Filters::Grok do
         }
       CONFIG
       sample "hello world" do
-        insist { subject["tags"] }.nil?
-        insist { subject["foo"] } == "hello"
+        insist { subject.get("tags") }.nil?
+        insist { subject.get("foo") } == "hello"
       end
     end
 
@@ -350,8 +350,8 @@ describe LogStash::Filters::Grok do
       CONFIG
 
       sample "fancy 12-12-12 12:12:12" do
-        insist { subject["tags"] }.nil?
-        insist { subject["timestamp"] } == "12-12-12 12:12:12"
+        insist { subject.get("tags") }.nil?
+        insist { subject.get("timestamp") } == "12-12-12 12:12:12"
       end
     end
   end
@@ -367,8 +367,8 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample("status" => 403) do
-      reject { subject["tags"] }.include?("_grokparsefailure")
-      insist { subject["tags"] }.include?("four_oh_three")
+      reject { subject.get("tags") }.include?("_grokparsefailure")
+      insist { subject.get("tags") }.include?("four_oh_three")
     end
   end
 
@@ -383,8 +383,8 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample("version" => 1.0) do
-      insist { subject["tags"] }.include?("one_point_oh")
-      insist { subject["tags"] }.include?("one_point_oh")
+      insist { subject.get("tags") }.include?("one_point_oh")
+      insist { subject.get("tags") }.include?("one_point_oh")
     end
   end
 
@@ -411,7 +411,7 @@ describe LogStash::Filters::Grok do
     )
     log_level_names.each do |level_name|
       sample "#{level_name}: error!" do
-        insist { subject['level'] } == level_name
+        insist { subject.get("level") } == level_name
       end
     end
   end
@@ -427,11 +427,11 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample "matchme 1234" do
-      insist { subject["tags"] }.nil?
+      insist { subject.get("tags") }.nil?
     end
 
     sample "this will not be matched" do
-      insist { subject["tags"] }.include?("false")
+      insist { subject.get("tags") }.include?("false")
     end
   end
 
@@ -446,7 +446,7 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample "11/01/01" do
-      insist { subject["stimestamp"] } == "11/01/01"
+      insist { subject.get("stimestamp") } == "11/01/01"
     end
   end
 
@@ -461,7 +461,7 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample "hello world" do
-      insist { subject["foo-bar"] } == "hello"
+      insist { subject.get("foo-bar") } == "hello"
     end
   end
 
@@ -509,11 +509,11 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample "hello world" do
-      insist { subject["foo"] }.is_a?(String)
+      insist { subject.get("foo") }.is_a?(String)
     end
 
     sample "123 world" do
-      insist { subject["foo"] }.is_a?(String)
+      insist { subject.get("foo") }.is_a?(String)
     end
   end
 
@@ -528,8 +528,8 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample("message" => "hello world 123", "somefield" => "testme abc 999") do
-      insist { subject["foo"] } == "123"
-      insist { subject["bar"] }.nil?
+      insist { subject.get("foo") } == "123"
+      insist { subject.get("bar") }.nil?
     end
   end
 
@@ -545,8 +545,8 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample("message" => "hello world 123", "somefield" => "testme abc 999") do
-      insist { subject["foo"] } == "123"
-      insist { subject["bar"] } == "999"
+      insist { subject.get("foo") } == "123"
+      insist { subject.get("bar") } == "999"
     end
   end
 
@@ -561,16 +561,16 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample "treebranch" do
-      insist { subject["name2"] } == "branch"
+      insist { subject.get("name2") } == "branch"
     end
 
     sample "bushbeard" do
-      insist { subject["name1"] } == "bush"
+      insist { subject.get("name1") } == "bush"
     end
 
     sample "treebeard" do
-      insist { subject["name1"] } == "tree"
-      insist { subject["name2"] } == "beard"
+      insist { subject.get("name1") } == "tree"
+      insist { subject.get("name2") } == "beard"
     end
   end
 
@@ -585,14 +585,14 @@ describe LogStash::Filters::Grok do
 
     # array input --
     sample("message" => ["hello world 123", "line 23"]) do
-      insist { subject["foo"] } == ["123", "23"]
-      insist { subject["tags"] }.nil?
+      insist { subject.get("foo") } == ["123", "23"]
+      insist { subject.get("tags") }.nil?
     end
 
     # array input, one of them matches
     sample("message" => ["hello world 123", "abc"]) do
-      insist { subject["foo"] } == "123"
-      insist { subject["tags"] }.nil?
+      insist { subject.get("foo") } == "123"
+      insist { subject.get("tags") }.nil?
     end
   end
 
@@ -607,16 +607,16 @@ describe LogStash::Filters::Grok do
 
     # array input --
     sample("message" => ["hello world 123", "line 23"]) do
-      insist { subject["foo"] } == ["123", "23"]
-      insist { subject["bar"] }.nil?
-      insist { subject["tags"] }.nil?
+      insist { subject.get("foo") } == ["123", "23"]
+      insist { subject.get("bar") }.nil?
+      insist { subject.get("tags") }.nil?
     end
 
     # array input, one of them matches
     sample("message" => ["hello world", "line 23"]) do
-      insist { subject["bar"] } == "hello"
-      insist { subject["foo"] } == "23"
-      insist { subject["tags"] }.nil?
+      insist { subject.get("bar") } == "hello"
+      insist { subject.get("foo") } == "23"
+      insist { subject.get("tags") }.nil?
     end
   end
 
@@ -632,16 +632,16 @@ describe LogStash::Filters::Grok do
 
     # array input --
     sample("message" => ["hello world 123", "line 23"]) do
-      insist { subject["foo"] } == ["123", "23"]
-      insist { subject["bar"] } == ["hello", "line"]
-      insist { subject["tags"] }.nil?
+      insist { subject.get("foo") } == ["123", "23"]
+      insist { subject.get("bar") } == ["hello", "line"]
+      insist { subject.get("tags") }.nil?
     end
 
     # array input, one of them matches
     sample("message" => ["hello world", "line 23"]) do
-      insist { subject["bar"] } == ["hello", "line"]
-      insist { subject["foo"] } == "23"
-      insist { subject["tags"] }.nil?
+      insist { subject.get("bar") } == ["hello", "line"]
+      insist { subject.get("foo") } == "23"
+      insist { subject.get("tags") }.nil?
     end
   end
 
@@ -656,9 +656,9 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample "<22>Jan  4 07:50:46 mailmaster postfix/policy-spf[9454]: : SPF permerror (Junk encountered in record 'v=spf1 mx a:mail.domain.no ip4:192.168.0.4 �all'): Envelope-from: email@domain.no" do
-      insist { subject["tags"] }.nil?
-      insist { subject["syslog_pri"] } == "22"
-      insist { subject["syslog_program"] } == "postfix/policy-spf"
+      insist { subject.get("tags") }.nil?
+      insist { subject.get("syslog_pri") } == "22"
+      insist { subject.get("syslog_program") } == "postfix/policy-spf"
     end
   end
 
@@ -681,7 +681,7 @@ describe LogStash::Filters::Grok do
     end
 
     sample("message" => 'hello') do
-      insist { subject["tags"] } == ["_grokparsefailure"]
+      insist { subject.get("tags") } == ["_grokparsefailure"]
     end
 
     after do
@@ -713,7 +713,7 @@ describe LogStash::Filters::Grok do
     end
 
     sample("message" => '0') do
-      insist { subject["tags"] } == nil
+      insist { subject.get("tags") } == nil
     end
 
     after do
@@ -744,7 +744,7 @@ describe LogStash::Filters::Grok do
     end
 
     sample("message" => '0') do
-      insist { subject["tags"] } == nil
+      insist { subject.get("tags") } == nil
     end
 
     after do
@@ -764,18 +764,18 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample "test 28.4ms" do
-      insist { subject["duration"] } == 28.4
-      insist { subject["tags"] }.nil?
+      insist { subject.get("duration") } == 28.4
+      insist { subject.get("tags") }.nil?
     end
 
     sample "test N/A" do
       insist { insist { subject.to_hash }.include?("duration") }.fails
-      insist { subject["tags"] }.nil?
+      insist { subject.get("tags") }.nil?
     end
 
     sample "test abc" do
-      insist { subject["duration"] }.nil?
-      insist { subject["tags"] } == ["_grokparsefailure"]
+      insist { subject.get("duration") }.nil?
+      insist { subject.get("tags") } == ["_grokparsefailure"]
     end
   end
 
@@ -791,7 +791,7 @@ describe LogStash::Filters::Grok do
 
     sample "test N/A" do
       insist { subject.to_hash }.include?("duration")
-      insist { subject["tags"] }.nil?
+      insist { subject.get("tags") }.nil?
     end
 
   end
@@ -806,13 +806,13 @@ describe LogStash::Filters::Grok do
     CONFIG
 
     sample "test 28.4ms" do
-      insist { subject["duration"] } == "28.4"
-      insist { subject["tags"] }.nil?
+      insist { subject.get("duration") } == "28.4"
+      insist { subject.get("tags") }.nil?
     end
 
     sample "test N/A" do
-      insist { subject["duration"] }.nil?
-      insist { subject["tags"] }.nil?
+      insist { subject.get("duration") }.nil?
+      insist { subject.get("tags") }.nil?
     end
   end
 

metadata

@@ -1,72 +1,74 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-grok
 version: !ruby/object:Gem::Version
-  version: 2.0.5
+  version: 3.0.0
 platform: ruby
 authors:
 - Elastic
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-03-24 00:00:00.000000000 Z
+date: 2016-05-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
+  name: logstash-core-plugin-api
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
-  name: logstash-core-plugin-api
-  prerelease: false
+        version: '2.0'
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
+  name: jls-grok
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.11.1
-  name: jls-grok
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.11.1
 - !ruby/object:Gem::Dependency
+  name: logstash-patterns-core
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  name: logstash-patterns-core
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
+  name: logstash-devutils
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  name: logstash-devutils
-  prerelease: false
   type: :development
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program
+description: This gem is a Logstash plugin required to be installed on top of the
+  Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
+  gem is not a stand-alone program
 email: info@elastic.co
 executables: []
 extensions: []
@@ -87,7 +89,7 @@ licenses:
 metadata:
   logstash_plugin: 'true'
   logstash_group: filter
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -102,9 +104,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project:
-rubygems_version: 2.4.8
-signing_key:
+rubyforge_project: 
+rubygems_version: 2.5.1
+signing_key: 
 specification_version: 4
 summary: Parse arbitrary text and structure it.
 test_files: