logstash-filter-kv 3.1.1 → 4.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +6 -1
- data/CONTRIBUTORS +1 -0
- data/lib/logstash/filters/kv.rb +52 -11
- data/logstash-filter-kv.gemspec +1 -1
- data/spec/filters/kv_spec.rb +62 -2
- metadata +3 -3
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: bd187e13f268bccf3d773032be91182db9539218
|
4
|
+
data.tar.gz: 3869c2cd4527da8298067f4558d809b7c034e87d
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: f6d25cd2beb66fad753125e9f0f49806dbf908771ab7ef1ec73584feb5538b36857cec4ba5e6f75df30aecab87d5ee2b573d6c60b9b22096a3cc27484859e42f
|
7
|
+
data.tar.gz: 905f6b2f0fc3ab89dfe95a3cfbd2b5e76a7f50835e0722eea69e94b4e01b387386252dacb76200c512d2390d1579647d6863c8138f5e2ee43d3bbb1cd9112552
|
data/CHANGELOG.md
CHANGED
@@ -1,5 +1,10 @@
|
|
1
|
+
## 4.0.0
|
2
|
+
- breaking: trim and trimkey options are renamed to trim_value and trim_key
|
3
|
+
- bugfix: trim_value and trim_key options now remove only leading and trailing characters (#10)
|
4
|
+
- feature: new options remove_char_value and remove_char_key to remove all characters from keys/values whatever their position
|
5
|
+
|
1
6
|
## 3.1.1
|
2
|
-
- Relax constraint on logstash-core-plugin-api to >= 1.60 <= 2.99
|
7
|
+
- internal,deps: Relax constraint on logstash-core-plugin-api to >= 1.60 <= 2.99
|
3
8
|
|
4
9
|
## 3.1.0
|
5
10
|
- Adds :transform_value and :transform_key options to lowercase/upcase or capitalize all keys/values
|
data/CONTRIBUTORS
CHANGED
@@ -19,6 +19,7 @@ Contributors:
|
|
19
19
|
* Scott Bessler (scottbessler)
|
20
20
|
* Suyog Rao (suyograo)
|
21
21
|
* piavlo
|
22
|
+
* Fabien Baligand (fbaligand)
|
22
23
|
|
23
24
|
Note: If you've sent us patches, bug reports, or otherwise contributed to
|
24
25
|
Logstash, and you aren't on the list above and want to be, please let us know
|
data/lib/logstash/filters/kv.rb
CHANGED
@@ -41,14 +41,16 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
41
41
|
# These characters form a regex character class and thus you must escape special regex
|
42
42
|
# characters like `[` or `]` using `\`.
|
43
43
|
#
|
44
|
-
#
|
44
|
+
# Only leading and trailing characters are trimed from the value.
|
45
|
+
#
|
46
|
+
# For example, to trim `<`, `>`, `[`, `]` and `,` characters from values:
|
45
47
|
# [source,ruby]
|
46
48
|
# filter {
|
47
49
|
# kv {
|
48
|
-
#
|
50
|
+
# trim_value => "<>\[\],"
|
49
51
|
# }
|
50
52
|
# }
|
51
|
-
config :
|
53
|
+
config :trim_value, :validate => :string
|
52
54
|
|
53
55
|
# A string of characters to trim from the key. This is useful if your
|
54
56
|
# keys are wrapped in brackets or start with space.
|
@@ -56,14 +58,48 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
56
58
|
# These characters form a regex character class and thus you must escape special regex
|
57
59
|
# characters like `[` or `]` using `\`.
|
58
60
|
#
|
59
|
-
#
|
61
|
+
# Only leading and trailing characters are trimed from the key.
|
62
|
+
#
|
63
|
+
# For example, to trim `<` `>` `[` `]` and `,` characters from keys:
|
64
|
+
# [source,ruby]
|
65
|
+
# filter {
|
66
|
+
# kv {
|
67
|
+
# trim_key => "<>\[\],"
|
68
|
+
# }
|
69
|
+
# }
|
70
|
+
config :trim_key, :validate => :string
|
71
|
+
|
72
|
+
# A string of characters to remove from the value.
|
73
|
+
#
|
74
|
+
# These characters form a regex character class and thus you must escape special regex
|
75
|
+
# characters like `[` or `]` using `\`.
|
76
|
+
#
|
77
|
+
# Contrary to trim option, all characters are removed from the value, whatever their position.
|
78
|
+
#
|
79
|
+
# For example, to remove `<`, `>`, `[`, `]` and `,` characters from values:
|
60
80
|
# [source,ruby]
|
61
81
|
# filter {
|
62
82
|
# kv {
|
63
|
-
#
|
83
|
+
# remove_char_value => "<>\[\],"
|
64
84
|
# }
|
65
85
|
# }
|
66
|
-
config :
|
86
|
+
config :remove_char_value, :validate => :string
|
87
|
+
|
88
|
+
# A string of characters to remove from the key.
|
89
|
+
#
|
90
|
+
# These characters form a regex character class and thus you must escape special regex
|
91
|
+
# characters like `[` or `]` using `\`.
|
92
|
+
#
|
93
|
+
# Contrary to trim option, all characters are removed from the key, whatever their position.
|
94
|
+
#
|
95
|
+
# For example, to remove `<` `>` `[` `]` and `,` characters from keys:
|
96
|
+
# [source,ruby]
|
97
|
+
# filter {
|
98
|
+
# kv {
|
99
|
+
# remove_char_key => "<>\[\],"
|
100
|
+
# }
|
101
|
+
# }
|
102
|
+
config :remove_char_key, :validate => :string
|
67
103
|
|
68
104
|
# Transform values to lower case, upper case or capitals.
|
69
105
|
#
|
@@ -190,7 +226,7 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
190
226
|
# one unique key/value pair will be preserved.
|
191
227
|
#
|
192
228
|
# For example, consider a source like `from=me from=me`. `[from]` will map to
|
193
|
-
# an Array with two elements: `["me", "me"]`.
|
229
|
+
# an Array with two elements: `["me", "me"]`. To only keep unique key/value pairs,
|
194
230
|
# you could use this configuration:
|
195
231
|
# [source,ruby]
|
196
232
|
# filter {
|
@@ -250,8 +286,11 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
250
286
|
)
|
251
287
|
end
|
252
288
|
|
253
|
-
@
|
254
|
-
@
|
289
|
+
@trim_value_re = Regexp.new("^[#{@trim_value}]|[#{@trim_value}]$") if @trim_value
|
290
|
+
@trim_key_re = Regexp.new("^[#{@trim_key}]|[#{@trim_key}]$") if @trim_key
|
291
|
+
|
292
|
+
@remove_char_value_re = Regexp.new("[#{@remove_char_value}]") if @remove_char_value
|
293
|
+
@remove_char_key_re = Regexp.new("[#{@remove_char_key}]") if @remove_char_key
|
255
294
|
|
256
295
|
valueRxString = "(?:\"([^\"]+)\"|'([^']+)'"
|
257
296
|
valueRxString += "|\\(([^\\)]+)\\)|\\[([^\\]]+)\\]|<([^>]+)>" if @include_brackets
|
@@ -317,7 +356,8 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
317
356
|
|
318
357
|
text.scan(@scan_re) do |key, v1, v2, v3, v4, v5, v6|
|
319
358
|
value = v1 || v2 || v3 || v4 || v5 || v6
|
320
|
-
key = @
|
359
|
+
key = @trim_key ? key.gsub(@trim_key_re, "") : key
|
360
|
+
key = @remove_char_key ? key.gsub(@remove_char_key_re, "") : key
|
321
361
|
key = @transform_key ? transform(key, @transform_key) : key
|
322
362
|
|
323
363
|
# Bail out as per the values of include_keys and exclude_keys
|
@@ -327,7 +367,8 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
327
367
|
|
328
368
|
key = event.sprintf(@prefix) + key
|
329
369
|
|
330
|
-
value = @
|
370
|
+
value = @trim_value ? value.gsub(@trim_value_re, "") : value
|
371
|
+
value = @remove_char_value ? value.gsub(@remove_char_value_re, "") : value
|
331
372
|
value = @transform_value ? transform(value, @transform_value) : value
|
332
373
|
|
333
374
|
# Bail out if inserting duplicate value in key mapping when unique_values
|
data/logstash-filter-kv.gemspec
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-kv'
|
4
|
-
s.version = '
|
4
|
+
s.version = '4.0.0'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "This filter helps automatically parse messages (or specific event fields) which are of the 'foo=bar' variety."
|
7
7
|
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
data/spec/filters/kv_spec.rb
CHANGED
@@ -676,7 +676,7 @@ describe LogStash::Filters::KV do
|
|
676
676
|
{
|
677
677
|
"field_split" => "\r\n",
|
678
678
|
"value_split" => " ",
|
679
|
-
"
|
679
|
+
"trim_key" => ":"
|
680
680
|
}
|
681
681
|
}
|
682
682
|
|
@@ -686,7 +686,67 @@ describe LogStash::Filters::KV do
|
|
686
686
|
expect(event.get("AccountStatus")).to eq("4")
|
687
687
|
expect(event.get("IsSuccess")).to eq("True")
|
688
688
|
expect(event.to_hash.keys.sort).to eq(
|
689
|
-
["@timestamp", "@version", "AccountStatus", "IsSuccess", "message"])
|
689
|
+
["@timestamp", "@version", "AccountStatus", "IsSuccess", "message", "tags"])
|
690
|
+
end
|
691
|
+
end
|
692
|
+
end
|
693
|
+
|
694
|
+
describe "trim_key/trim_value options : trim only leading and trailing spaces in keys/values (reported in #10)" do
|
695
|
+
subject do
|
696
|
+
plugin = LogStash::Filters::KV.new(options)
|
697
|
+
plugin.register
|
698
|
+
plugin
|
699
|
+
end
|
700
|
+
|
701
|
+
let(:message) { "key1= value1 with spaces | key2 with spaces =value2" }
|
702
|
+
let(:data) { {"message" => message} }
|
703
|
+
let(:event) { LogStash::Event.new(data) }
|
704
|
+
let(:options) {
|
705
|
+
{
|
706
|
+
"field_split" => "\|",
|
707
|
+
"value_split" => "=",
|
708
|
+
"trim_value" => " ",
|
709
|
+
"trim_key" => " "
|
710
|
+
}
|
711
|
+
}
|
712
|
+
|
713
|
+
context "key and value with leading, trailing and middle spaces" do
|
714
|
+
it "should trim only leading and trailing spaces" do
|
715
|
+
subject.filter(event)
|
716
|
+
expect(event.get("key1")).to eq("value1 with spaces")
|
717
|
+
expect(event.get("key2 with spaces")).to eq("value2")
|
718
|
+
expect(event.to_hash.keys.sort).to eq(
|
719
|
+
["@timestamp", "@version", "key1", "key2 with spaces", "message", "tags"])
|
720
|
+
end
|
721
|
+
end
|
722
|
+
end
|
723
|
+
|
724
|
+
describe "remove_char_key/remove_char_value options : remove all characters in keys/values whatever their position" do
|
725
|
+
subject do
|
726
|
+
plugin = LogStash::Filters::KV.new(options)
|
727
|
+
plugin.register
|
728
|
+
plugin
|
729
|
+
end
|
730
|
+
|
731
|
+
let(:message) { "key1= value1 with spaces | key2 with spaces =value2" }
|
732
|
+
let(:data) { {"message" => message} }
|
733
|
+
let(:event) { LogStash::Event.new(data) }
|
734
|
+
let(:options) {
|
735
|
+
{
|
736
|
+
"field_split" => "\|",
|
737
|
+
"value_split" => "=",
|
738
|
+
"remove_char_value" => " ",
|
739
|
+
"remove_char_key" => " "
|
740
|
+
}
|
741
|
+
}
|
742
|
+
|
743
|
+
context "key and value with leading, trailing and middle spaces" do
|
744
|
+
it "should remove all spaces" do
|
745
|
+
subject.filter(event)
|
746
|
+
expect(event.get("key1")).to eq("value1withspaces")
|
747
|
+
expect(event.get("key2withspaces")).to eq("value2")
|
748
|
+
expect(event.to_hash.keys.sort).to eq(
|
749
|
+
["@timestamp", "@version", "key1", "key2withspaces", "message", "tags"])
|
690
750
|
end
|
691
751
|
end
|
692
752
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-kv
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 4.0.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2017-02-06 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|
@@ -81,7 +81,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
81
81
|
version: '0'
|
82
82
|
requirements: []
|
83
83
|
rubyforge_project:
|
84
|
-
rubygems_version: 2.
|
84
|
+
rubygems_version: 2.4.8
|
85
85
|
signing_key:
|
86
86
|
specification_version: 4
|
87
87
|
summary: This filter helps automatically parse messages (or specific event fields) which are of the 'foo=bar' variety.
|