logstash-filter-kv 3.1.1 → 4.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +6 -1
- data/CONTRIBUTORS +1 -0
- data/lib/logstash/filters/kv.rb +52 -11
- data/logstash-filter-kv.gemspec +1 -1
- data/spec/filters/kv_spec.rb +62 -2
- metadata +3 -3
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: bd187e13f268bccf3d773032be91182db9539218
|
4
|
+
data.tar.gz: 3869c2cd4527da8298067f4558d809b7c034e87d
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: f6d25cd2beb66fad753125e9f0f49806dbf908771ab7ef1ec73584feb5538b36857cec4ba5e6f75df30aecab87d5ee2b573d6c60b9b22096a3cc27484859e42f
|
7
|
+
data.tar.gz: 905f6b2f0fc3ab89dfe95a3cfbd2b5e76a7f50835e0722eea69e94b4e01b387386252dacb76200c512d2390d1579647d6863c8138f5e2ee43d3bbb1cd9112552
|
data/CHANGELOG.md
CHANGED
@@ -1,5 +1,10 @@
|
|
1
|
+
## 4.0.0
|
2
|
+
- breaking: trim and trimkey options are renamed to trim_value and trim_key
|
3
|
+
- bugfix: trim_value and trim_key options now remove only leading and trailing characters (#10)
|
4
|
+
- feature: new options remove_char_value and remove_char_key to remove all characters from keys/values whatever their position
|
5
|
+
|
1
6
|
## 3.1.1
|
2
|
-
- Relax constraint on logstash-core-plugin-api to >= 1.60 <= 2.99
|
7
|
+
- internal,deps: Relax constraint on logstash-core-plugin-api to >= 1.60 <= 2.99
|
3
8
|
|
4
9
|
## 3.1.0
|
5
10
|
- Adds :transform_value and :transform_key options to lowercase/upcase or capitalize all keys/values
|
data/CONTRIBUTORS
CHANGED
@@ -19,6 +19,7 @@ Contributors:
|
|
19
19
|
* Scott Bessler (scottbessler)
|
20
20
|
* Suyog Rao (suyograo)
|
21
21
|
* piavlo
|
22
|
+
* Fabien Baligand (fbaligand)
|
22
23
|
|
23
24
|
Note: If you've sent us patches, bug reports, or otherwise contributed to
|
24
25
|
Logstash, and you aren't on the list above and want to be, please let us know
|
data/lib/logstash/filters/kv.rb
CHANGED
@@ -41,14 +41,16 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
41
41
|
# These characters form a regex character class and thus you must escape special regex
|
42
42
|
# characters like `[` or `]` using `\`.
|
43
43
|
#
|
44
|
-
#
|
44
|
+
# Only leading and trailing characters are trimed from the value.
|
45
|
+
#
|
46
|
+
# For example, to trim `<`, `>`, `[`, `]` and `,` characters from values:
|
45
47
|
# [source,ruby]
|
46
48
|
# filter {
|
47
49
|
# kv {
|
48
|
-
#
|
50
|
+
# trim_value => "<>\[\],"
|
49
51
|
# }
|
50
52
|
# }
|
51
|
-
config :
|
53
|
+
config :trim_value, :validate => :string
|
52
54
|
|
53
55
|
# A string of characters to trim from the key. This is useful if your
|
54
56
|
# keys are wrapped in brackets or start with space.
|
@@ -56,14 +58,48 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
56
58
|
# These characters form a regex character class and thus you must escape special regex
|
57
59
|
# characters like `[` or `]` using `\`.
|
58
60
|
#
|
59
|
-
#
|
61
|
+
# Only leading and trailing characters are trimed from the key.
|
62
|
+
#
|
63
|
+
# For example, to trim `<` `>` `[` `]` and `,` characters from keys:
|
64
|
+
# [source,ruby]
|
65
|
+
# filter {
|
66
|
+
# kv {
|
67
|
+
# trim_key => "<>\[\],"
|
68
|
+
# }
|
69
|
+
# }
|
70
|
+
config :trim_key, :validate => :string
|
71
|
+
|
72
|
+
# A string of characters to remove from the value.
|
73
|
+
#
|
74
|
+
# These characters form a regex character class and thus you must escape special regex
|
75
|
+
# characters like `[` or `]` using `\`.
|
76
|
+
#
|
77
|
+
# Contrary to trim option, all characters are removed from the value, whatever their position.
|
78
|
+
#
|
79
|
+
# For example, to remove `<`, `>`, `[`, `]` and `,` characters from values:
|
60
80
|
# [source,ruby]
|
61
81
|
# filter {
|
62
82
|
# kv {
|
63
|
-
#
|
83
|
+
# remove_char_value => "<>\[\],"
|
64
84
|
# }
|
65
85
|
# }
|
66
|
-
config :
|
86
|
+
config :remove_char_value, :validate => :string
|
87
|
+
|
88
|
+
# A string of characters to remove from the key.
|
89
|
+
#
|
90
|
+
# These characters form a regex character class and thus you must escape special regex
|
91
|
+
# characters like `[` or `]` using `\`.
|
92
|
+
#
|
93
|
+
# Contrary to trim option, all characters are removed from the key, whatever their position.
|
94
|
+
#
|
95
|
+
# For example, to remove `<` `>` `[` `]` and `,` characters from keys:
|
96
|
+
# [source,ruby]
|
97
|
+
# filter {
|
98
|
+
# kv {
|
99
|
+
# remove_char_key => "<>\[\],"
|
100
|
+
# }
|
101
|
+
# }
|
102
|
+
config :remove_char_key, :validate => :string
|
67
103
|
|
68
104
|
# Transform values to lower case, upper case or capitals.
|
69
105
|
#
|
@@ -190,7 +226,7 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
190
226
|
# one unique key/value pair will be preserved.
|
191
227
|
#
|
192
228
|
# For example, consider a source like `from=me from=me`. `[from]` will map to
|
193
|
-
# an Array with two elements: `["me", "me"]`.
|
229
|
+
# an Array with two elements: `["me", "me"]`. To only keep unique key/value pairs,
|
194
230
|
# you could use this configuration:
|
195
231
|
# [source,ruby]
|
196
232
|
# filter {
|
@@ -250,8 +286,11 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
250
286
|
)
|
251
287
|
end
|
252
288
|
|
253
|
-
@
|
254
|
-
@
|
289
|
+
@trim_value_re = Regexp.new("^[#{@trim_value}]|[#{@trim_value}]$") if @trim_value
|
290
|
+
@trim_key_re = Regexp.new("^[#{@trim_key}]|[#{@trim_key}]$") if @trim_key
|
291
|
+
|
292
|
+
@remove_char_value_re = Regexp.new("[#{@remove_char_value}]") if @remove_char_value
|
293
|
+
@remove_char_key_re = Regexp.new("[#{@remove_char_key}]") if @remove_char_key
|
255
294
|
|
256
295
|
valueRxString = "(?:\"([^\"]+)\"|'([^']+)'"
|
257
296
|
valueRxString += "|\\(([^\\)]+)\\)|\\[([^\\]]+)\\]|<([^>]+)>" if @include_brackets
|
@@ -317,7 +356,8 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
317
356
|
|
318
357
|
text.scan(@scan_re) do |key, v1, v2, v3, v4, v5, v6|
|
319
358
|
value = v1 || v2 || v3 || v4 || v5 || v6
|
320
|
-
key = @
|
359
|
+
key = @trim_key ? key.gsub(@trim_key_re, "") : key
|
360
|
+
key = @remove_char_key ? key.gsub(@remove_char_key_re, "") : key
|
321
361
|
key = @transform_key ? transform(key, @transform_key) : key
|
322
362
|
|
323
363
|
# Bail out as per the values of include_keys and exclude_keys
|
@@ -327,7 +367,8 @@ class LogStash::Filters::KV < LogStash::Filters::Base
|
|
327
367
|
|
328
368
|
key = event.sprintf(@prefix) + key
|
329
369
|
|
330
|
-
value = @
|
370
|
+
value = @trim_value ? value.gsub(@trim_value_re, "") : value
|
371
|
+
value = @remove_char_value ? value.gsub(@remove_char_value_re, "") : value
|
331
372
|
value = @transform_value ? transform(value, @transform_value) : value
|
332
373
|
|
333
374
|
# Bail out if inserting duplicate value in key mapping when unique_values
|
data/logstash-filter-kv.gemspec
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-kv'
|
4
|
-
s.version = '
|
4
|
+
s.version = '4.0.0'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "This filter helps automatically parse messages (or specific event fields) which are of the 'foo=bar' variety."
|
7
7
|
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
data/spec/filters/kv_spec.rb
CHANGED
@@ -676,7 +676,7 @@ describe LogStash::Filters::KV do
|
|
676
676
|
{
|
677
677
|
"field_split" => "\r\n",
|
678
678
|
"value_split" => " ",
|
679
|
-
"
|
679
|
+
"trim_key" => ":"
|
680
680
|
}
|
681
681
|
}
|
682
682
|
|
@@ -686,7 +686,67 @@ describe LogStash::Filters::KV do
|
|
686
686
|
expect(event.get("AccountStatus")).to eq("4")
|
687
687
|
expect(event.get("IsSuccess")).to eq("True")
|
688
688
|
expect(event.to_hash.keys.sort).to eq(
|
689
|
-
["@timestamp", "@version", "AccountStatus", "IsSuccess", "message"])
|
689
|
+
["@timestamp", "@version", "AccountStatus", "IsSuccess", "message", "tags"])
|
690
|
+
end
|
691
|
+
end
|
692
|
+
end
|
693
|
+
|
694
|
+
describe "trim_key/trim_value options : trim only leading and trailing spaces in keys/values (reported in #10)" do
|
695
|
+
subject do
|
696
|
+
plugin = LogStash::Filters::KV.new(options)
|
697
|
+
plugin.register
|
698
|
+
plugin
|
699
|
+
end
|
700
|
+
|
701
|
+
let(:message) { "key1= value1 with spaces | key2 with spaces =value2" }
|
702
|
+
let(:data) { {"message" => message} }
|
703
|
+
let(:event) { LogStash::Event.new(data) }
|
704
|
+
let(:options) {
|
705
|
+
{
|
706
|
+
"field_split" => "\|",
|
707
|
+
"value_split" => "=",
|
708
|
+
"trim_value" => " ",
|
709
|
+
"trim_key" => " "
|
710
|
+
}
|
711
|
+
}
|
712
|
+
|
713
|
+
context "key and value with leading, trailing and middle spaces" do
|
714
|
+
it "should trim only leading and trailing spaces" do
|
715
|
+
subject.filter(event)
|
716
|
+
expect(event.get("key1")).to eq("value1 with spaces")
|
717
|
+
expect(event.get("key2 with spaces")).to eq("value2")
|
718
|
+
expect(event.to_hash.keys.sort).to eq(
|
719
|
+
["@timestamp", "@version", "key1", "key2 with spaces", "message", "tags"])
|
720
|
+
end
|
721
|
+
end
|
722
|
+
end
|
723
|
+
|
724
|
+
describe "remove_char_key/remove_char_value options : remove all characters in keys/values whatever their position" do
|
725
|
+
subject do
|
726
|
+
plugin = LogStash::Filters::KV.new(options)
|
727
|
+
plugin.register
|
728
|
+
plugin
|
729
|
+
end
|
730
|
+
|
731
|
+
let(:message) { "key1= value1 with spaces | key2 with spaces =value2" }
|
732
|
+
let(:data) { {"message" => message} }
|
733
|
+
let(:event) { LogStash::Event.new(data) }
|
734
|
+
let(:options) {
|
735
|
+
{
|
736
|
+
"field_split" => "\|",
|
737
|
+
"value_split" => "=",
|
738
|
+
"remove_char_value" => " ",
|
739
|
+
"remove_char_key" => " "
|
740
|
+
}
|
741
|
+
}
|
742
|
+
|
743
|
+
context "key and value with leading, trailing and middle spaces" do
|
744
|
+
it "should remove all spaces" do
|
745
|
+
subject.filter(event)
|
746
|
+
expect(event.get("key1")).to eq("value1withspaces")
|
747
|
+
expect(event.get("key2withspaces")).to eq("value2")
|
748
|
+
expect(event.to_hash.keys.sort).to eq(
|
749
|
+
["@timestamp", "@version", "key1", "key2withspaces", "message", "tags"])
|
690
750
|
end
|
691
751
|
end
|
692
752
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-kv
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 4.0.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2017-02-06 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|
@@ -81,7 +81,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
81
81
|
version: '0'
|
82
82
|
requirements: []
|
83
83
|
rubyforge_project:
|
84
|
-
rubygems_version: 2.
|
84
|
+
rubygems_version: 2.4.8
|
85
85
|
signing_key:
|
86
86
|
specification_version: 4
|
87
87
|
summary: This filter helps automatically parse messages (or specific event fields) which are of the 'foo=bar' variety.
|