logstash-filter-hex 0.0.3

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 22593899b5affe13383d361fd20c5c2a3e93df0e
+  data.tar.gz: 4c847773fb39e8119cab4b84366ac0723c5c45ca
+SHA512:
+  metadata.gz: 0b1854db5590b52ae7a1bf2f58df8aec091c19d1e8a4da3902819fedcefae902e72a3104fe83fca05089e8d9f4c7846ab300543dc24b8905e2999575df00eb0a
+  data.tar.gz: fae21298935049949c588404e108444167fb0b548b41660a094da9b2ec8e527f92715803e021a39fe233cc797474235bf92011ceaa4a7b8503b8ac481153f644

checksums.yaml.gz.sig

@@ -0,0 +1,3 @@
+Yw"�n1NlD9�8%��)z,�W���
+�[����~U*��7�����kTކ����W�v^��v�֕Q�ܡ��:z�
+_�
�ri!�r���=#��bn�4�fzi�Z�R���15�\m�΃��<�Q��t�$q�`

data/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gemspec

data/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2016 MilCERT - Fabian Franz
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

data/README.md

@@ -0,0 +1,39 @@
+# Logstash Hex Filter
+
+This filter helps you to hex encode/decode your fields.
+
+## Decode fields
+
+```
+hex {
+    fields => ["key_1", "key_2"]
+}
+```
+
+## Encode field
+
+```
+hex {
+    fields => ["key_1", "key_2"]
+    action => "encode"
+}
+```
+
+## Filter options
+
+* **action**
+
+  If the content should be encoded (`encode`) or decoded (`decode`) The default value is `decode`.
+
+* **fields**
+
+  The fields to encode or decode. Defaults to `message`.
+  
+* **type**
+
+  If you want to encode or decode the field as a `string` or an `integer`.
+
+## Note
+
+This filter has been written by Fabian Franz and has been provided to you by austrian milCERT.
+

data/lib/logstash/filters/hex.rb

@@ -0,0 +1,46 @@
+# encoding: utf-8
+
+require "logstash/filters/base"
+require "logstash/namespace"
+
+class LogStash::Filters::Hex < LogStash::Filters::Base
+
+  config_name "hex"
+
+  config :action, :validate => ["decode", "encode"], :default => "decode"
+  config :type, :validate => ["string", "integer"], :default => "string"
+
+  # The fields to encode or decode as an array of names
+  config :fields, :validate => :array, :default => "message"
+
+  def register
+  end
+
+  def filter(event)
+    @fields.each do |field|
+      next if field.nil?
+      value = event.get(field)
+      next if value.nil?
+
+      case @action
+      when "encode"
+        if @type == "string"
+          event.set(field, value.unpack("H*").first)
+        else
+          event.set(field, value.to_i.to_s(16))
+        end
+      when "decode"
+        if value =~ /^[a-f0-9]+$/i
+          if @type == "string"
+            event.set(field, [value].pack("H*"))
+          else
+            event.set(field, value.to_i(16).to_s)
+          end
+        else
+        end
+      end
+    end
+
+    filter_matched(event)
+  end
+end

data/logstash-filter-hex.gemspec

@@ -0,0 +1,19 @@
+Gem::Specification.new do |s|
+  s.name = 'logstash-filter-hex'
+  s.version = '0.0.3'
+  s.licenses = ['Apache-2.0']
+  s.summary = "This filter helps you encode and decode fields in hex."
+  s.description = "Logstash plugin to encode and decode hex."
+  s.authors = ["Fabian Franz"]
+  s.email = 'franz.fabian.94@gmail.com'
+  s.homepage = "http://github.com/fabianfrz/logstash-filter-hex"
+  s.require_paths = ["lib"]
+  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','Gemfile','LICENSE']
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
+  s.cert_chain  = ['certs/fabianfrz.pem']
+  s.signing_key = File.expand_path("~/.ssh/gem-private_key.pem") if $0 =~ /gem\z/
+
+  s.add_runtime_dependency "logstash-core", ">= 1.0"
+  s.add_development_dependency 'logstash-devutils', '~> 1.1'
+end

data/spec/spec_helper.rb

@@ -0,0 +1,2 @@
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"

metadata

@@ -0,0 +1,103 @@
+--- !ruby/object:Gem::Specification
+name: logstash-filter-hex
+version: !ruby/object:Gem::Version
+  version: 0.0.3
+platform: ruby
+authors:
+- Fabian Franz
+autorequire: 
+bindir: bin
+cert_chain:
+- |
+  -----BEGIN CERTIFICATE-----
+  MIIDjjCCAnagAwIBAgIBATANBgkqhkiG9w0BAQUFADBGMRgwFgYDVQQDDA9mcmFu
+  ei5mYWJpYW4uOTQxFTATBgoJkiaJk/IsZAEZFgVnbWFpbDETMBEGCgmSJomT8ixk
+  ARkWA2NvbTAeFw0xNjExMDQxNDQyMDBaFw0xNzExMDQxNDQyMDBaMEYxGDAWBgNV
+  BAMMD2ZyYW56LmZhYmlhbi45NDEVMBMGCgmSJomT8ixkARkWBWdtYWlsMRMwEQYK
+  CZImiZPyLGQBGRYDY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+  6J54PM3chIlLQqWz7BkUh6JC0tf+aUtaOCUdv07e0rCpVkk2R3DQt99wXcGCjtxa
+  uEI4riCixEHlzpAL3YYFvM7v2NzQMdDW/updeflgNl6Q4eeZDYybgunxLjK6VNWq
+  vvsrYhxMXlBqjxRoyoRYcP+uTVEFvehf9NHSaeDWE3xt10o8UJoNaOQwMIrNAG7E
+  KD1Iau/7W6Bk7qJqpUiaF5o6ilp7V4UzGrZtwEHbdV6Cr2k56rJfwBByDivbDZFR
+  quA0Wqi+WKp+waGUNlq6caucgh3c5FwGg6FyIeaqnb60SBugQ4WUk5q1luvdMuZU
+  9LixR9++XGKztJsdsvRuIQIDAQABo4GGMIGDMAkGA1UdEwQCMAAwCwYDVR0PBAQD
+  AgSwMB0GA1UdDgQWBBQIS4sgv5BytfrCbMXuFWOkaKpxqjAkBgNVHREEHTAbgRlm
+  cmFuei5mYWJpYW4uOTRAZ21haWwuY29tMCQGA1UdEgQdMBuBGWZyYW56LmZhYmlh
+  bi45NEBnbWFpbC5jb20wDQYJKoZIhvcNAQEFBQADggEBAJNWYyRFpXl6iuNQTqen
+  Q1qLVxH1b318/pfI7PxtuoPlCwGncpkTvr7H6oJXbb2OJ/zOCweIL6xmOOTnqFon
+  PMu+j0YSdx/NfbpWBiBdYiVYa7ZlkrYjd31GLmojaOI1NaWFQRTberN645HG8E+z
+  vwSFsQ9sj4hvrO7ttWiJICOBkHkK8xv3Wa4o6meQ+8jcS2IDCOOJH4u9ArC4yoQv
+  4+NdSy/34UsWqr3DRFdHX2UYbmuAo/kknLJLAoMVHtIud1rl355m5SbT1NOgxRhv
+  5uOo0mfcMahkspPrrSxTMnF1NNOpmCJbnJNzg4QCTgEQpS7p6r2KT7V5BLJLACmx
+  vW0=
+  -----END CERTIFICATE-----
+date: 2016-11-04 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: logstash-core
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: logstash-devutils
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+description: Logstash plugin to encode and decode hex.
+email: franz.fabian.94@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- Gemfile
+- LICENSE
+- README.md
+- lib/logstash/filters/hex.rb
+- logstash-filter-hex.gemspec
+- spec/spec_helper.rb
+homepage: http://github.com/fabianfrz/logstash-filter-hex
+licenses:
+- Apache-2.0
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: filter
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.5.1
+signing_key: 
+specification_version: 4
+summary: This filter helps you encode and decode fields in hex.
+test_files:
+- spec/spec_helper.rb