logstash-filter-kv 2.0.7 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +3 -0
- data/LICENSE +1 -1
- data/README.md +12 -3
- data/lib/logstash/filters/kv.rb +40 -0
- data/logstash-filter-kv.gemspec +2 -2
- data/spec/filters/kv_spec.rb +60 -0
- metadata +10 -10
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 63ffef94da43256770287a0a3f1e25791617f74a
|
4
|
+
data.tar.gz: e36145dfaf5d8184e4dd7d60418c9c36dcfab319
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: f7bd945d5df9b1eaae90b399910612d5236c8ff0bcf55ab4feedbe87995e39a0dcb09cccc3139a6afd2dafdaf998ed1ed02625f31a957e76cae812285fc72780
|
7
|
+
data.tar.gz: ff374c0ac7d74d7c2f3f772a28481c89122cc21fcac883843a4873475c508d71f31e85eec0aac4a11baa947ea9a624e3bfbcfbfaf8128f6ded14c5082271681b
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,6 @@
|
|
1
|
+
# 2.1.0
|
2
|
+
- Adds :transform_value and :transform_key options to lowercase/upcase or capitalize all keys/values
|
3
|
+
|
1
4
|
# 2.0.7
|
2
5
|
- With include_brackets enabled, angle brackets (\< and \>) are treated the same as square brackets and parentheses, making it easy to parse strings like "a=\<b\> c=\<d\>".
|
3
6
|
- An empty value_split option value now gives a useful error message.
|
data/LICENSE
CHANGED
data/README.md
CHANGED
@@ -1,7 +1,6 @@
|
|
1
1
|
# Logstash Plugin
|
2
2
|
|
3
|
-
[](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Filters/job/logstash-plugin-filter-kv-unit/)
|
3
|
+
[](https://travis-ci.org/logstash-plugins/logstash-filter-kv)
|
5
4
|
|
6
5
|
This is a plugin for [Logstash](https://github.com/elastic/logstash).
|
7
6
|
|
@@ -56,7 +55,12 @@ gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
|
|
56
55
|
```
|
57
56
|
- Install plugin
|
58
57
|
```sh
|
58
|
+
# Logstash 2.3 and higher
|
59
|
+
bin/logstash-plugin install --no-verify
|
60
|
+
|
61
|
+
# Prior to Logstash 2.3
|
59
62
|
bin/plugin install --no-verify
|
63
|
+
|
60
64
|
```
|
61
65
|
- Run Logstash with your plugin
|
62
66
|
```sh
|
@@ -74,7 +78,12 @@ gem build logstash-filter-awesome.gemspec
|
|
74
78
|
```
|
75
79
|
- Install the plugin from the Logstash home
|
76
80
|
```sh
|
77
|
-
|
81
|
+
# Logstash 2.3 and higher
|
82
|
+
bin/logstash-plugin install --no-verify
|
83
|
+
|
84
|
+
# Prior to Logstash 2.3
|
85
|
+
bin/plugin install --no-verify
|
86
|
+
|
78
87
|
```
|
79
88
|
- Start Logstash and proceed to test the plugin
|
80
89
|
|
data/lib/logstash/filters/kv.rb
CHANGED
@@ -29,6 +29,11 @@ require "logstash/namespace"
|
|
29
29
|
class LogStash::Filters::KV < LogStash::Filters::Base
|
30
30
|
config_name "kv"
|
31
31
|
|
32
|
+
# Constants used for transform check
|
33
|
+
TRANSFORM_LOWERCASE_KEY = "lowercase"
|
34
|
+
TRANSFORM_UPPERCASE_KEY = "uppercase"
|
35
|
+
TRANSFORM_CAPITALIZE_KEY = "capitalize"
|
36
|
+
|
32
37
|
# A string of characters to trim from the value. This is useful if your
|
33
38
|
# values are wrapped in brackets or are terminated with commas (like postfix
|
34
39
|
# logs).
|
@@ -60,6 +65,28 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
60
65
|
# }
|
61
66
|
config :trimkey, :validate => :string
|
62
67
|
|
68
|
+
# Transform values to lower case, upper case or capitals.
|
69
|
+
#
|
70
|
+
# For example, to capitalize all values:
|
71
|
+
# [source,ruby]
|
72
|
+
# filter {
|
73
|
+
# kv {
|
74
|
+
# transform_value => "capitalize"
|
75
|
+
# }
|
76
|
+
# }
|
77
|
+
config :transform_value, :validate => [TRANSFORM_LOWERCASE_KEY, TRANSFORM_UPPERCASE_KEY, TRANSFORM_CAPITALIZE_KEY]
|
78
|
+
|
79
|
+
# Transform keys to lower case, upper case or capitals.
|
80
|
+
#
|
81
|
+
# For example, to lowercase all keys:
|
82
|
+
# [source,ruby]
|
83
|
+
# filter {
|
84
|
+
# kv {
|
85
|
+
# transform_key => "lowercase"
|
86
|
+
# }
|
87
|
+
# }
|
88
|
+
config :transform_key, :validate => [TRANSFORM_LOWERCASE_KEY, TRANSFORM_UPPERCASE_KEY, TRANSFORM_CAPITALIZE_KEY]
|
89
|
+
|
63
90
|
# A string of characters to use as delimiters for parsing out key-value pairs.
|
64
91
|
#
|
65
92
|
# These characters form a regex character class and thus you must escape special regex
|
@@ -269,6 +296,17 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
269
296
|
s =~ @value_split_re
|
270
297
|
end
|
271
298
|
|
299
|
+
def transform(text, method)
|
300
|
+
case method
|
301
|
+
when TRANSFORM_LOWERCASE_KEY
|
302
|
+
return text.downcase
|
303
|
+
when TRANSFORM_UPPERCASE_KEY
|
304
|
+
return text.upcase
|
305
|
+
when TRANSFORM_CAPITALIZE_KEY
|
306
|
+
return text.capitalize
|
307
|
+
end
|
308
|
+
end
|
309
|
+
|
272
310
|
def parse(text, event, kv_keys)
|
273
311
|
# short circuit parsing if the text does not contain the @value_split
|
274
312
|
return kv_keys unless has_value_splitter?(text)
|
@@ -280,6 +318,7 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
280
318
|
text.scan(@scan_re) do |key, v1, v2, v3, v4, v5, v6|
|
281
319
|
value = v1 || v2 || v3 || v4 || v5 || v6
|
282
320
|
key = @trimkey ? key.gsub(@trimkey_re, "") : key
|
321
|
+
key = @transform_key ? transform(key, @transform_key) : key
|
283
322
|
|
284
323
|
# Bail out as per the values of include_keys and exclude_keys
|
285
324
|
next if not include_keys.empty? and not include_keys.include?(key)
|
@@ -289,6 +328,7 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
289
328
|
key = event.sprintf(@prefix) + key
|
290
329
|
|
291
330
|
value = @trim ? value.gsub(@trim_re, "") : value
|
331
|
+
value = @transform_value ? transform(value, @transform_value) : value
|
292
332
|
|
293
333
|
# Bail out if inserting duplicate value in key mapping when unique_values
|
294
334
|
# option is set to true.
|
data/logstash-filter-kv.gemspec
CHANGED
@@ -1,10 +1,10 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-kv'
|
4
|
-
s.version = '2.0
|
4
|
+
s.version = '2.1.0'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "This filter helps automatically parse messages (or specific event fields) which are of the 'foo=bar' variety."
|
7
|
-
s.description = "This gem is a
|
7
|
+
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
8
8
|
s.authors = ["Elastic"]
|
9
9
|
s.email = 'info@elastic.co'
|
10
10
|
s.homepage = "http://www.elastic.co/guide/en/logstash/current/index.html"
|
data/spec/filters/kv_spec.rb
CHANGED
@@ -26,6 +26,66 @@ describe LogStash::Filters::KV do
|
|
26
26
|
end
|
27
27
|
end
|
28
28
|
|
29
|
+
describe "test transforming keys to uppercase and values to lowercase" do
|
30
|
+
config <<-CONFIG
|
31
|
+
filter {
|
32
|
+
kv {
|
33
|
+
transform_key => "uppercase"
|
34
|
+
transform_value => "lowercase"
|
35
|
+
}
|
36
|
+
}
|
37
|
+
CONFIG
|
38
|
+
|
39
|
+
sample "hello = world Foo =Bar BAZ= FIZZ doublequoteD = \"hellO worlD\" Singlequoted= 'Hello World' brAckets =(hello World)" do
|
40
|
+
insist { subject["HELLO"] } == "world"
|
41
|
+
insist { subject["FOO"] } == "bar"
|
42
|
+
insist { subject["BAZ"] } == "fizz"
|
43
|
+
insist { subject["DOUBLEQUOTED"] } == "hello world"
|
44
|
+
insist { subject["SINGLEQUOTED"] } == "hello world"
|
45
|
+
insist { subject["BRACKETS"] } == "hello world"
|
46
|
+
end
|
47
|
+
end
|
48
|
+
|
49
|
+
describe "test transforming keys to lowercase and values to uppercase" do
|
50
|
+
config <<-CONFIG
|
51
|
+
filter {
|
52
|
+
kv {
|
53
|
+
transform_key => "lowercase"
|
54
|
+
transform_value => "uppercase"
|
55
|
+
}
|
56
|
+
}
|
57
|
+
CONFIG
|
58
|
+
|
59
|
+
sample "Hello = World fOo =bar baz= FIZZ DOUBLEQUOTED = \"hellO worlD\" singlequoted= 'hEllo wOrld' brackets =(HELLO world)" do
|
60
|
+
insist { subject["hello"] } == "WORLD"
|
61
|
+
insist { subject["foo"] } == "BAR"
|
62
|
+
insist { subject["baz"] } == "FIZZ"
|
63
|
+
insist { subject["doublequoted"] } == "HELLO WORLD"
|
64
|
+
insist { subject["singlequoted"] } == "HELLO WORLD"
|
65
|
+
insist { subject["brackets"] } == "HELLO WORLD"
|
66
|
+
end
|
67
|
+
end
|
68
|
+
|
69
|
+
describe "test transforming keys and values to capitals" do
|
70
|
+
config <<-CONFIG
|
71
|
+
filter {
|
72
|
+
kv {
|
73
|
+
transform_key => "capitalize"
|
74
|
+
transform_value => "capitalize"
|
75
|
+
}
|
76
|
+
}
|
77
|
+
CONFIG
|
78
|
+
|
79
|
+
sample "Hello = World fOo =bar baz= FIZZ DOUBLEQUOTED = \"hellO worlD\" singlequoted= 'hEllo wOrld' brackets =(HELLO world)" do
|
80
|
+
insist { subject["Hello"] } == "World"
|
81
|
+
insist { subject["Foo"] } == "Bar"
|
82
|
+
insist { subject["Baz"] } == "Fizz"
|
83
|
+
insist { subject["Doublequoted"] } == "Hello world"
|
84
|
+
insist { subject["Singlequoted"] } == "Hello world"
|
85
|
+
insist { subject["Brackets"] } == "Hello world"
|
86
|
+
end
|
87
|
+
end
|
88
|
+
|
29
89
|
describe "test spaces attached to the field_split" do
|
30
90
|
config <<-CONFIG
|
31
91
|
filter {
|
metadata
CHANGED
@@ -1,19 +1,19 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-kv
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 2.0
|
4
|
+
version: 2.1.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2016-
|
11
|
+
date: 2016-05-20 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|
15
15
|
requirements:
|
16
|
-
- - ~>
|
16
|
+
- - "~>"
|
17
17
|
- !ruby/object:Gem::Version
|
18
18
|
version: '1.0'
|
19
19
|
name: logstash-core-plugin-api
|
@@ -21,13 +21,13 @@ dependencies:
|
|
21
21
|
type: :runtime
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
|
-
- - ~>
|
24
|
+
- - "~>"
|
25
25
|
- !ruby/object:Gem::Version
|
26
26
|
version: '1.0'
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
requirement: !ruby/object:Gem::Requirement
|
29
29
|
requirements:
|
30
|
-
- -
|
30
|
+
- - ">="
|
31
31
|
- !ruby/object:Gem::Version
|
32
32
|
version: '0'
|
33
33
|
name: logstash-devutils
|
@@ -35,10 +35,10 @@ dependencies:
|
|
35
35
|
type: :development
|
36
36
|
version_requirements: !ruby/object:Gem::Requirement
|
37
37
|
requirements:
|
38
|
-
- -
|
38
|
+
- - ">="
|
39
39
|
- !ruby/object:Gem::Version
|
40
40
|
version: '0'
|
41
|
-
description: This gem is a
|
41
|
+
description: This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program
|
42
42
|
email: info@elastic.co
|
43
43
|
executables: []
|
44
44
|
extensions: []
|
@@ -65,17 +65,17 @@ require_paths:
|
|
65
65
|
- lib
|
66
66
|
required_ruby_version: !ruby/object:Gem::Requirement
|
67
67
|
requirements:
|
68
|
-
- -
|
68
|
+
- - ">="
|
69
69
|
- !ruby/object:Gem::Version
|
70
70
|
version: '0'
|
71
71
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
72
72
|
requirements:
|
73
|
-
- -
|
73
|
+
- - ">="
|
74
74
|
- !ruby/object:Gem::Version
|
75
75
|
version: '0'
|
76
76
|
requirements: []
|
77
77
|
rubyforge_project:
|
78
|
-
rubygems_version: 2.
|
78
|
+
rubygems_version: 2.6.3
|
79
79
|
signing_key:
|
80
80
|
specification_version: 4
|
81
81
|
summary: This filter helps automatically parse messages (or specific event fields) which are of the 'foo=bar' variety.
|