logstash-filter-grok 3.0.1 → 3.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 518aabe176da0e624b62775a380dd3a405b0f178
-  data.tar.gz: e1ee4539e93edc19fdff4118f9b5f7d4557e596a
+  metadata.gz: 4496fd80858b9f3beffe2624dede994c83c3c49f
+  data.tar.gz: 149364b7446e2671928270f2ed23ba1f1efe93fa
 SHA512:
-  metadata.gz: 605a941fa330828af63678f573e830e3cdcaaa86ecaa6bbb444432ce5bfc24c378b01e31f0496518bf2d24912a2e2cd4bd3a0ce93589a45f69144e30450bb5f3
-  data.tar.gz: 01fca5615a8bafa3a8fd397ad9fd44cc4f955f16824cbf2ac85b1af23836a2fddfede8d0a577fb79a15a898dde3a413daef842bf77f21bf234b250486b94d59d
+  metadata.gz: a7f3f873745dfeb0422d7a7414ebed203bbb2bd0b7e6ed8ee7ebb3c5a7457521f1185dbbacba37a8c5298486d3167d26e80cbe0efb6c95171567b96ffadc0aa0
+  data.tar.gz: e7cc9ad9efd6dfe7b7457c4c5e0988dfd7b58e1cd3dc1f58ed101f248789409ffbc2593f1613dc374730f9877658ceaebb2bd947e526237127b86935246d9985

data/CHANGELOG.md

@@ -1,15 +1,26 @@
+## 3.1.1
+ - Added metrics for failed, matched and number of patters per field.
+
+## 3.1.0
+ - breaking,config: Remove deprecated config `singles`.
+ - breaking,config: Remove deprecated config `pattern`. Please use `match => { "message" => ""}` syntax.
+
 ## 3.0.1
-  - Republish all the gems under jruby.
+ - internal: Republish all the gems under jruby.
+
 ## 3.0.0
-  - Update the plugin to the version 2.0 of the plugin api, this change is required for Logstash 5.0 compatibility. See https://github.com/elastic/logstash/issues/5141
-# 2.0.5
-  - Depend on logstash-core-plugin-api instead of logstash-core, removing the need to mass update plugins on major releases of logstash
-# 2.0.4
-  - New dependency requirements for logstash-core for the 5.0 release
+ - internal,deps: Update the plugin to the version 2.0 of the plugin api, this change is required for Logstash 5.0 compatibility. See https://github.com/elastic/logstash/issues/5141
+
+## 2.0.5
+ - internal,deps: Depend on logstash-core-plugin-api instead of logstash-core, removing the need to mass update plugins on major releases of logstash
+
+## 2.0.4
+ - internal,deps: New dependency requirements for logstash-core for the 5.0 release
+
 ## 2.0.3
- - fix fieldref assignment to avoid assumption on mutable object
+ - internal: fix fieldref assignment to avoid assumption on mutable object
+
 ## 2.0.0
- - Plugins were updated to follow the new shutdown semantic, this mainly allows Logstash to instruct input plugins to terminate gracefully,
+ - internal: Plugins were updated to follow the new shutdown semantic, this mainly allows Logstash to instruct input plugins to terminate gracefully,
    instead of using Thread.raise on the plugins' threads. Ref: https://github.com/elastic/logstash/pull/3895
- - Dependency on logstash-core update to 2.0
-
+ - internal,deps: Dependency on logstash-core update to 2.0

data/lib/logstash/filters/grok.rb

@@ -139,12 +139,6 @@
   class LogStash::Filters::Grok < LogStash::Filters::Base
     config_name "grok"
 
-    # Specify a pattern to parse with. This will match the `message` field.
-    #
-    # If you want to match other fields than message, use the `match` setting.
-    # Multiple patterns is fine.
-    config :pattern, :validate => :array, :deprecated => "You should use this instead: match => { \"message\" => \"your pattern here\" }"
-
     # A hash of matches of field => value
     #
     # For example:
@@ -195,10 +189,6 @@
     # If `true`, keep empty captures as event fields.
     config :keep_empty_captures, :validate => :boolean, :default => false
 
-    # If `true`, make single-value fields simply that value, not an array
-    # containing that one value.
-    config :singles, :validate => :boolean, :default => true, :deprecated => "This behavior is the default now, you don't need to set it."
-
     # Append values to the `tags` field when there has been no
     # successful match
     config :tag_on_failure, :validate => :array, :default => ["_grokparsefailure"]
@@ -231,8 +221,6 @@
     public
     def initialize(params)
       super(params)
-      @match["message"] ||= []
-      @match["message"] += @pattern if @pattern # the config 'pattern' value (array)
       # a cache of capture name handler methods.
       @handlers = {}
     end
@@ -252,8 +240,11 @@
 
       @logger.info? and @logger.info("Match data", :match => @match)
 
+      @metric_match_fields = metric.namespace(:patterns_per_field)
+
       @match.each do |field, patterns|
         patterns = [patterns] if patterns.is_a?(String)
+        @metric_match_fields.gauge(field, patterns.length)
 
         @logger.info? and @logger.info("Grok compile", :field => field, :patterns => patterns)
         patterns.each do |pattern|
@@ -282,8 +273,10 @@
       end # @patterns.each
 
       if matched
+        metric.increment(:matches)
         filter_matched(event)
       else
+        metric.increment(:failures)
         @tag_on_failure.each{|tag| event.tag(tag)}
       end
 

data/logstash-filter-grok.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-grok'
-  s.version         = '3.0.1'
+  s.version         = '3.1.1'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Parse arbitrary text and structure it."
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

data/spec/filters/grok_spec.rb

@@ -29,7 +29,6 @@ describe LogStash::Filters::Grok do
       filter {
         grok {
           match => { "message" => "%{SYSLOGLINE}" }
-          singles => true
           overwrite => [ "message" ]
         }
       }
@@ -52,7 +51,6 @@ describe LogStash::Filters::Grok do
       filter {
         grok {
           match => { "message" => "%{SYSLOG5424LINE}" }
-          singles => true
         }
       }
     CONFIG
@@ -195,7 +193,6 @@ describe LogStash::Filters::Grok do
       filter {
         grok {
           match => { "message" => "%{NUMBER:foo:int} %{NUMBER:bar:float}" }
-          singles => true
         }
       }
     CONFIG
@@ -214,7 +211,6 @@ describe LogStash::Filters::Grok do
         grok {
           match => { "message" => "%{FIZZLE=\\d+}" }
           named_captures_only => false
-          singles => true
         }
       }
     CONFIG
@@ -231,7 +227,6 @@ describe LogStash::Filters::Grok do
           match => { "message" => "%{WORD:word}" }
           match => { "examplefield" => "%{NUMBER:num}" }
           break_on_match => false
-          singles => true
         }
       }
     CONFIG
@@ -247,7 +242,6 @@ describe LogStash::Filters::Grok do
       filter {
         grok {
           match => { "message" => "matchme %{NUMBER:fancy}" }
-          singles => true
           add_field => [ "new_field", "%{fancy}" ]
         }
       }
@@ -310,7 +304,6 @@ describe LogStash::Filters::Grok do
         grok {
           match => { "message" => "Hello %{WORD}. %{WORD:foo}" }
           named_captures_only => false
-          singles => true
         }
       }
     CONFIG
@@ -328,7 +321,6 @@ describe LogStash::Filters::Grok do
       config <<-'CONFIG'
         filter {
           grok {
-            singles => true
             match => { "message" => "(?<foo>\w+)" }
           }
         }
@@ -343,7 +335,6 @@ describe LogStash::Filters::Grok do
       config <<-'CONFIG'
         filter {
           grok {
-            singles => true
             match => { "message" => "(?<timestamp>%{DATE_EU} %{TIME})" }
           }
         }
@@ -392,7 +383,7 @@ describe LogStash::Filters::Grok do
     config <<-'CONFIG'
       filter {
         grok {
-          pattern => "%{LOGLEVEL:level}: error!"
+          match => { "message" => "%{LOGLEVEL:level}: error!" }
         }
       }
     CONFIG
@@ -440,7 +431,6 @@ describe LogStash::Filters::Grok do
       filter {
         grok {
           match => { "message" => "%{DATE_EU:stimestamp}" }
-          singles => true
         }
       }
     CONFIG
@@ -455,7 +445,6 @@ describe LogStash::Filters::Grok do
       filter {
         grok {
           match => { "message" => "%{WORD:foo-bar}" }
-          singles => true
         }
       }
     CONFIG
@@ -481,7 +470,6 @@ describe LogStash::Filters::Grok do
       filter {
         grok {
           match => { "message" => "%{SYSLOGLINE}" }
-          singles => true
           overwrite => [ "message" ]
         }
       }
@@ -498,12 +486,11 @@ describe LogStash::Filters::Grok do
     end
   end
 
-  describe "singles with duplicate-named fields" do
+  describe "single value match with duplicate-named fields in pattern" do
     config <<-CONFIG
       filter {
         grok {
           match => { "message" => "%{INT:foo}|%{WORD:foo}" }
-          singles => true
         }
       }
     CONFIG
@@ -649,8 +636,8 @@ describe LogStash::Filters::Grok do
     config <<-CONFIG
       filter {
         grok {
-          #pattern => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}"
-          pattern => "<%{POSINT:syslog_pri}>%{SPACE}%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(:?)(?:\\[%{GREEDYDATA:syslog_pid}\\])?(:?) %{GREEDYDATA:syslog_message}"
+          #match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
+          match => { "message" => "<%{POSINT:syslog_pri}>%{SPACE}%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(:?)(?:\\[%{GREEDYDATA:syslog_pid}\\])?(:?) %{GREEDYDATA:syslog_message}" }
         }
       }
     CONFIG
@@ -677,7 +664,7 @@ describe LogStash::Filters::Grok do
     end
 
     let(:config) do
-      'filter { grok { pattern => "%{WORD:word}" } }'
+      'filter { grok { match => { "message" => "%{WORD:word}" } } }'
     end
 
     sample("message" => 'hello') do
@@ -709,7 +696,7 @@ describe LogStash::Filters::Grok do
     end
 
     let(:config) do
-      "filter { grok { patterns_dir => \"#{tmpdir}\" pattern => \"%{WORD:word}\" } }"
+      "filter { grok { patterns_dir => \"#{tmpdir}\" match => { \"message\" => \"%{WORD:word}\" } } }"
     end
 
     sample("message" => '0') do
@@ -740,7 +727,7 @@ describe LogStash::Filters::Grok do
     end
 
     let(:config) do
-      "filter { grok { patterns_dir => \"#{tmpdir}\" patterns_files_glob => \"*.pattern\" pattern => \"%{WORD:word}\" } }"
+      "filter { grok { patterns_dir => \"#{tmpdir}\" patterns_files_glob => \"*.pattern\" match => { \"message\" => \"%{WORD:word}\" } } }"
     end
 
     sample("message" => '0') do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-grok
 version: !ruby/object:Gem::Version
-  version: 3.0.1
+  version: 3.1.1
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2016-05-09 00:00:00.000000000 Z
+date: 2016-06-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement