logstash-filter-kv 2.0.7 → 2.1.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +3 -0
- data/LICENSE +1 -1
- data/README.md +12 -3
- data/lib/logstash/filters/kv.rb +40 -0
- data/logstash-filter-kv.gemspec +2 -2
- data/spec/filters/kv_spec.rb +60 -0
- metadata +10 -10
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 63ffef94da43256770287a0a3f1e25791617f74a
|
4
|
+
data.tar.gz: e36145dfaf5d8184e4dd7d60418c9c36dcfab319
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: f7bd945d5df9b1eaae90b399910612d5236c8ff0bcf55ab4feedbe87995e39a0dcb09cccc3139a6afd2dafdaf998ed1ed02625f31a957e76cae812285fc72780
|
7
|
+
data.tar.gz: ff374c0ac7d74d7c2f3f772a28481c89122cc21fcac883843a4873475c508d71f31e85eec0aac4a11baa947ea9a624e3bfbcfbfaf8128f6ded14c5082271681b
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,6 @@
|
|
1
|
+
# 2.1.0
|
2
|
+
- Adds :transform_value and :transform_key options to lowercase/upcase or capitalize all keys/values
|
3
|
+
|
1
4
|
# 2.0.7
|
2
5
|
- With include_brackets enabled, angle brackets (\< and \>) are treated the same as square brackets and parentheses, making it easy to parse strings like "a=\<b\> c=\<d\>".
|
3
6
|
- An empty value_split option value now gives a useful error message.
|
data/LICENSE
CHANGED
data/README.md
CHANGED
@@ -1,7 +1,6 @@
|
|
1
1
|
# Logstash Plugin
|
2
2
|
|
3
|
-
[![Build
|
4
|
-
Status](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Filters/job/logstash-plugin-filter-kv-unit/badge/icon)](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Filters/job/logstash-plugin-filter-kv-unit/)
|
3
|
+
[![Travis Build Status](https://travis-ci.org/logstash-plugins/logstash-filter-kv.svg)](https://travis-ci.org/logstash-plugins/logstash-filter-kv)
|
5
4
|
|
6
5
|
This is a plugin for [Logstash](https://github.com/elastic/logstash).
|
7
6
|
|
@@ -56,7 +55,12 @@ gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
|
|
56
55
|
```
|
57
56
|
- Install plugin
|
58
57
|
```sh
|
58
|
+
# Logstash 2.3 and higher
|
59
|
+
bin/logstash-plugin install --no-verify
|
60
|
+
|
61
|
+
# Prior to Logstash 2.3
|
59
62
|
bin/plugin install --no-verify
|
63
|
+
|
60
64
|
```
|
61
65
|
- Run Logstash with your plugin
|
62
66
|
```sh
|
@@ -74,7 +78,12 @@ gem build logstash-filter-awesome.gemspec
|
|
74
78
|
```
|
75
79
|
- Install the plugin from the Logstash home
|
76
80
|
```sh
|
77
|
-
|
81
|
+
# Logstash 2.3 and higher
|
82
|
+
bin/logstash-plugin install --no-verify
|
83
|
+
|
84
|
+
# Prior to Logstash 2.3
|
85
|
+
bin/plugin install --no-verify
|
86
|
+
|
78
87
|
```
|
79
88
|
- Start Logstash and proceed to test the plugin
|
80
89
|
|
data/lib/logstash/filters/kv.rb
CHANGED
@@ -29,6 +29,11 @@ require "logstash/namespace"
|
|
29
29
|
class LogStash::Filters::KV < LogStash::Filters::Base
|
30
30
|
config_name "kv"
|
31
31
|
|
32
|
+
# Constants used for transform check
|
33
|
+
TRANSFORM_LOWERCASE_KEY = "lowercase"
|
34
|
+
TRANSFORM_UPPERCASE_KEY = "uppercase"
|
35
|
+
TRANSFORM_CAPITALIZE_KEY = "capitalize"
|
36
|
+
|
32
37
|
# A string of characters to trim from the value. This is useful if your
|
33
38
|
# values are wrapped in brackets or are terminated with commas (like postfix
|
34
39
|
# logs).
|
@@ -60,6 +65,28 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
60
65
|
# }
|
61
66
|
config :trimkey, :validate => :string
|
62
67
|
|
68
|
+
# Transform values to lower case, upper case or capitals.
|
69
|
+
#
|
70
|
+
# For example, to capitalize all values:
|
71
|
+
# [source,ruby]
|
72
|
+
# filter {
|
73
|
+
# kv {
|
74
|
+
# transform_value => "capitalize"
|
75
|
+
# }
|
76
|
+
# }
|
77
|
+
config :transform_value, :validate => [TRANSFORM_LOWERCASE_KEY, TRANSFORM_UPPERCASE_KEY, TRANSFORM_CAPITALIZE_KEY]
|
78
|
+
|
79
|
+
# Transform keys to lower case, upper case or capitals.
|
80
|
+
#
|
81
|
+
# For example, to lowercase all keys:
|
82
|
+
# [source,ruby]
|
83
|
+
# filter {
|
84
|
+
# kv {
|
85
|
+
# transform_key => "lowercase"
|
86
|
+
# }
|
87
|
+
# }
|
88
|
+
config :transform_key, :validate => [TRANSFORM_LOWERCASE_KEY, TRANSFORM_UPPERCASE_KEY, TRANSFORM_CAPITALIZE_KEY]
|
89
|
+
|
63
90
|
# A string of characters to use as delimiters for parsing out key-value pairs.
|
64
91
|
#
|
65
92
|
# These characters form a regex character class and thus you must escape special regex
|
@@ -269,6 +296,17 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
269
296
|
s =~ @value_split_re
|
270
297
|
end
|
271
298
|
|
299
|
+
def transform(text, method)
|
300
|
+
case method
|
301
|
+
when TRANSFORM_LOWERCASE_KEY
|
302
|
+
return text.downcase
|
303
|
+
when TRANSFORM_UPPERCASE_KEY
|
304
|
+
return text.upcase
|
305
|
+
when TRANSFORM_CAPITALIZE_KEY
|
306
|
+
return text.capitalize
|
307
|
+
end
|
308
|
+
end
|
309
|
+
|
272
310
|
def parse(text, event, kv_keys)
|
273
311
|
# short circuit parsing if the text does not contain the @value_split
|
274
312
|
return kv_keys unless has_value_splitter?(text)
|
@@ -280,6 +318,7 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
280
318
|
text.scan(@scan_re) do |key, v1, v2, v3, v4, v5, v6|
|
281
319
|
value = v1 || v2 || v3 || v4 || v5 || v6
|
282
320
|
key = @trimkey ? key.gsub(@trimkey_re, "") : key
|
321
|
+
key = @transform_key ? transform(key, @transform_key) : key
|
283
322
|
|
284
323
|
# Bail out as per the values of include_keys and exclude_keys
|
285
324
|
next if not include_keys.empty? and not include_keys.include?(key)
|
@@ -289,6 +328,7 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
289
328
|
key = event.sprintf(@prefix) + key
|
290
329
|
|
291
330
|
value = @trim ? value.gsub(@trim_re, "") : value
|
331
|
+
value = @transform_value ? transform(value, @transform_value) : value
|
292
332
|
|
293
333
|
# Bail out if inserting duplicate value in key mapping when unique_values
|
294
334
|
# option is set to true.
|
data/logstash-filter-kv.gemspec
CHANGED
@@ -1,10 +1,10 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-kv'
|
4
|
-
s.version = '2.0
|
4
|
+
s.version = '2.1.0'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "This filter helps automatically parse messages (or specific event fields) which are of the 'foo=bar' variety."
|
7
|
-
s.description = "This gem is a
|
7
|
+
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
8
8
|
s.authors = ["Elastic"]
|
9
9
|
s.email = 'info@elastic.co'
|
10
10
|
s.homepage = "http://www.elastic.co/guide/en/logstash/current/index.html"
|
data/spec/filters/kv_spec.rb
CHANGED
@@ -26,6 +26,66 @@ describe LogStash::Filters::KV do
|
|
26
26
|
end
|
27
27
|
end
|
28
28
|
|
29
|
+
describe "test transforming keys to uppercase and values to lowercase" do
|
30
|
+
config <<-CONFIG
|
31
|
+
filter {
|
32
|
+
kv {
|
33
|
+
transform_key => "uppercase"
|
34
|
+
transform_value => "lowercase"
|
35
|
+
}
|
36
|
+
}
|
37
|
+
CONFIG
|
38
|
+
|
39
|
+
sample "hello = world Foo =Bar BAZ= FIZZ doublequoteD = \"hellO worlD\" Singlequoted= 'Hello World' brAckets =(hello World)" do
|
40
|
+
insist { subject["HELLO"] } == "world"
|
41
|
+
insist { subject["FOO"] } == "bar"
|
42
|
+
insist { subject["BAZ"] } == "fizz"
|
43
|
+
insist { subject["DOUBLEQUOTED"] } == "hello world"
|
44
|
+
insist { subject["SINGLEQUOTED"] } == "hello world"
|
45
|
+
insist { subject["BRACKETS"] } == "hello world"
|
46
|
+
end
|
47
|
+
end
|
48
|
+
|
49
|
+
describe "test transforming keys to lowercase and values to uppercase" do
|
50
|
+
config <<-CONFIG
|
51
|
+
filter {
|
52
|
+
kv {
|
53
|
+
transform_key => "lowercase"
|
54
|
+
transform_value => "uppercase"
|
55
|
+
}
|
56
|
+
}
|
57
|
+
CONFIG
|
58
|
+
|
59
|
+
sample "Hello = World fOo =bar baz= FIZZ DOUBLEQUOTED = \"hellO worlD\" singlequoted= 'hEllo wOrld' brackets =(HELLO world)" do
|
60
|
+
insist { subject["hello"] } == "WORLD"
|
61
|
+
insist { subject["foo"] } == "BAR"
|
62
|
+
insist { subject["baz"] } == "FIZZ"
|
63
|
+
insist { subject["doublequoted"] } == "HELLO WORLD"
|
64
|
+
insist { subject["singlequoted"] } == "HELLO WORLD"
|
65
|
+
insist { subject["brackets"] } == "HELLO WORLD"
|
66
|
+
end
|
67
|
+
end
|
68
|
+
|
69
|
+
describe "test transforming keys and values to capitals" do
|
70
|
+
config <<-CONFIG
|
71
|
+
filter {
|
72
|
+
kv {
|
73
|
+
transform_key => "capitalize"
|
74
|
+
transform_value => "capitalize"
|
75
|
+
}
|
76
|
+
}
|
77
|
+
CONFIG
|
78
|
+
|
79
|
+
sample "Hello = World fOo =bar baz= FIZZ DOUBLEQUOTED = \"hellO worlD\" singlequoted= 'hEllo wOrld' brackets =(HELLO world)" do
|
80
|
+
insist { subject["Hello"] } == "World"
|
81
|
+
insist { subject["Foo"] } == "Bar"
|
82
|
+
insist { subject["Baz"] } == "Fizz"
|
83
|
+
insist { subject["Doublequoted"] } == "Hello world"
|
84
|
+
insist { subject["Singlequoted"] } == "Hello world"
|
85
|
+
insist { subject["Brackets"] } == "Hello world"
|
86
|
+
end
|
87
|
+
end
|
88
|
+
|
29
89
|
describe "test spaces attached to the field_split" do
|
30
90
|
config <<-CONFIG
|
31
91
|
filter {
|
metadata
CHANGED
@@ -1,19 +1,19 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-kv
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 2.0
|
4
|
+
version: 2.1.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2016-
|
11
|
+
date: 2016-05-20 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|
15
15
|
requirements:
|
16
|
-
- - ~>
|
16
|
+
- - "~>"
|
17
17
|
- !ruby/object:Gem::Version
|
18
18
|
version: '1.0'
|
19
19
|
name: logstash-core-plugin-api
|
@@ -21,13 +21,13 @@ dependencies:
|
|
21
21
|
type: :runtime
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
|
-
- - ~>
|
24
|
+
- - "~>"
|
25
25
|
- !ruby/object:Gem::Version
|
26
26
|
version: '1.0'
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
requirement: !ruby/object:Gem::Requirement
|
29
29
|
requirements:
|
30
|
-
- -
|
30
|
+
- - ">="
|
31
31
|
- !ruby/object:Gem::Version
|
32
32
|
version: '0'
|
33
33
|
name: logstash-devutils
|
@@ -35,10 +35,10 @@ dependencies:
|
|
35
35
|
type: :development
|
36
36
|
version_requirements: !ruby/object:Gem::Requirement
|
37
37
|
requirements:
|
38
|
-
- -
|
38
|
+
- - ">="
|
39
39
|
- !ruby/object:Gem::Version
|
40
40
|
version: '0'
|
41
|
-
description: This gem is a
|
41
|
+
description: This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program
|
42
42
|
email: info@elastic.co
|
43
43
|
executables: []
|
44
44
|
extensions: []
|
@@ -65,17 +65,17 @@ require_paths:
|
|
65
65
|
- lib
|
66
66
|
required_ruby_version: !ruby/object:Gem::Requirement
|
67
67
|
requirements:
|
68
|
-
- -
|
68
|
+
- - ">="
|
69
69
|
- !ruby/object:Gem::Version
|
70
70
|
version: '0'
|
71
71
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
72
72
|
requirements:
|
73
|
-
- -
|
73
|
+
- - ">="
|
74
74
|
- !ruby/object:Gem::Version
|
75
75
|
version: '0'
|
76
76
|
requirements: []
|
77
77
|
rubyforge_project:
|
78
|
-
rubygems_version: 2.
|
78
|
+
rubygems_version: 2.6.3
|
79
79
|
signing_key:
|
80
80
|
specification_version: 4
|
81
81
|
summary: This filter helps automatically parse messages (or specific event fields) which are of the 'foo=bar' variety.
|