logstash-filter-json 3.0.6 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2ddf0449d8e4b3c20ad42da931a88623695222c346815463d100f184deb39a41
-  data.tar.gz: bd1c0786156077172f52eb2998b86030ec8524ed341a8b17544942f5b662f69e
+  metadata.gz: f084e6137c8f48a2f6a912ccf2b114d1b6fcf2ef3acef94f32f2b16311846728
+  data.tar.gz: 80aaab59b6691d0150a01681e5a00abde796284a5f4c8866f11349c6925c9adb
 SHA512:
-  metadata.gz: 191f3b6b17ae2d93c10d763fbe765bead21e1e6932986dd188a493d5e616245f2d9e6ec1956b3fbe29edfa9e3aa98a828d803b51fd12a18bd6fa860f26813700
-  data.tar.gz: 0a7189b4d3249b2a249b263c5fdfe0180b164f633fa2d90a1ec9d979cbdd0e9b18a02ff3fd92e9addc351699188074e93bea1ef43630ac42e4b6d5aa8c6b597c
+  metadata.gz: 9b4a20d9872d279858c788e42bf147ce9f8cc85ac88950d409b72a5f38e321f522bf7651682f8c6d5453a50aad4237e3a6e2f983c031e3ab4b24f64142d8538a
+  data.tar.gz: d5db418ac041b5169c3173b1f92070955ace448791a4c6b03168a4123478d89d387a7a0c14a54ab9e288a57be0683080794571a149dcd7b9e21982980e4ef14a

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 3.1.0
+ - Added better error handling, preventing some classes of malformed inputs from crashing the pipeline.
+
 ## 3.0.6
   - Updated documentation with some clarifications and fixes
 

data/lib/logstash/filters/json.rb

@@ -76,7 +76,7 @@ class LogStash::Filters::Json < LogStash::Filters::Base
       parsed = LogStash::Json.load(source)
     rescue => e
       unless @skip_on_invalid_json
-        @tag_on_failure.each{|tag| event.tag(tag)}
+        _do_tag_on_failure(event)
         @logger.warn("Error parsing json", :source => @source, :raw => source, :exception => e)
       end
       return
@@ -86,7 +86,7 @@ class LogStash::Filters::Json < LogStash::Filters::Base
       event.set(@target, parsed)
     else
       unless parsed.is_a?(Hash)
-        @tag_on_failure.each{|tag| event.tag(tag)}
+        _do_tag_on_failure(event)
         @logger.warn("Parsed JSON object/hash requires a target configuration option", :source => @source, :raw => source)
         return
       end
@@ -121,5 +121,14 @@ class LogStash::Filters::Json < LogStash::Filters::Base
     filter_matched(event)
 
     @logger.debug? && @logger.debug("Event after json filter", :event => event)
+  rescue => ex
+    meta = { :exception => ex.message, :source => @source, :raw => source}
+    meta[:backtrace] = ex.backtrace if logger.debug?
+    logger.warn('Exception caught in json filter', meta)
+    _do_tag_on_failure(event)
+  end
+
+  def _do_tag_on_failure(event)
+    @tag_on_failure.each { |tag| event.tag(tag) }
   end
 end

data/logstash-filter-json.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-json'
-  s.version         = '3.0.6'
+  s.version         = '3.1.0'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Parses JSON events"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

data/spec/filters/json_spec.rb

@@ -3,6 +3,7 @@
 require "logstash/devutils/rspec/spec_helper"
 require "logstash/filters/json"
 require "logstash/timestamp"
+require 'rubygems'
 
 describe LogStash::Filters::Json do
 
@@ -59,6 +60,52 @@ describe LogStash::Filters::Json do
     end
   end
 
+  logstash_version = Gem::Version.create(LOGSTASH_CORE_VERSION)
+
+  if (Gem::Requirement.create('>= 7.0').satisfied_by?(logstash_version) ||
+     (Gem::Requirement.create('~> 6.4').satisfied_by?(logstash_version) && LogStash::SETTINGS.get('config.field_reference.parser') == 'STRICT'))
+    describe "unsupported field name using `target`" do
+      config <<-CONFIG
+        filter {
+          json {
+            # Parse message as JSON, store the results in the 'data' field'
+            source => "message"
+            target => "data"
+            tag_on_failure => ["_jsonparsefailure","_custom_failure_tag"]
+          }
+        }
+      CONFIG
+
+      sample '{"okay":true, "un[sup]]ported": "foo", "another": "okay"}' do
+        insist { subject.get("tags") }.include?("_jsonparsefailure")
+        insist { subject.get("tags") }.include?("_custom_failure_tag")
+
+        # it does not partially apply
+        insist { subject.include?('[data][okay]') } == false
+        insist { subject.include?('[data][another]') } == false
+      end
+    end
+
+    describe "unsupported field name without target" do
+      config <<-CONFIG
+        filter {
+          json {
+            # Parse message as JSON, store the results in the 'data' field'
+            source => "message"
+            tag_on_failure => ["_jsonparsefailure","_custom_failure_tag"]
+          }
+        }
+      CONFIG
+
+      sample '{"okay":true, "un[sup]]ported": "foo", "another": "okay"}' do
+        insist { subject.get("tags") }.include?("_jsonparsefailure")
+        insist { subject.get("tags") }.include?("_custom_failure_tag")
+
+        # we can make no guarantees about partial application in this case.
+      end
+    end
+  end
+
   describe "fixing @timestamp (#pull 733)" do
     config <<-CONFIG
       filter {

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-json
 version: !ruby/object:Gem::Version
-  version: 3.0.6
+  version: 3.1.0
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-02-04 00:00:00.000000000 Z
+date: 2019-06-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement