logstash-filter-memorize 0.9.2 → 1.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.gitignore +1 -0
- data/README.md +25 -76
- data/lib/logstash/filters/memorize.rb +3 -3
- data/logstash-filter-memorize.gemspec +2 -2
- data/spec/filters/memorize_spec.rb +2 -2
- metadata +6 -6
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 5e3b24f20c11a391d6c477292111a5fc69b44568
|
4
|
+
data.tar.gz: aee862428ac8329c7680c24ee60eeb03d799c6bb
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: a759eedd6547c60a05950917aa4ede460b5dac332499bf2dddf5cddc3b7392412aa950741e1ca31f6a9d5556e37e0065b097ccdd183b2aa8c66ce2dfb476fc96
|
7
|
+
data.tar.gz: 3d1b5f6001a2a18ea857123b3cced4b38d45ff4b307478486a65ae20d282698338a6f28cfd2a858587824204367fed974a55f6091b1f7f63706472f35333559c
|
data/.gitignore
CHANGED
data/README.md
CHANGED
@@ -6,81 +6,30 @@ It is fully free and fully open source. The license is Apache 2.0, meaning you a
|
|
6
6
|
|
7
7
|
## Documentation
|
8
8
|
|
9
|
-
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
## Developing
|
19
|
-
|
20
|
-
### 1. Plugin Developement and Testing
|
21
|
-
|
22
|
-
#### Code
|
23
|
-
- To get started, you'll need JRuby with the Bundler gem installed.
|
24
|
-
|
25
|
-
- Create a new plugin or clone and existing from the GitHub [logstash-plugins](https://github.com/logstash-plugins) organization. We also provide [example plugins](https://github.com/logstash-plugins?query=example).
|
26
|
-
|
27
|
-
- Install dependencies
|
28
|
-
```sh
|
29
|
-
bundle install
|
30
|
-
```
|
31
|
-
|
32
|
-
#### Test
|
33
|
-
|
34
|
-
- Update your dependencies
|
35
|
-
|
36
|
-
```sh
|
37
|
-
bundle install
|
38
|
-
```
|
39
|
-
|
40
|
-
- Run tests
|
41
|
-
|
42
|
-
```sh
|
43
|
-
bundle exec rspec
|
44
|
-
```
|
45
|
-
|
46
|
-
### 2. Running your unpublished Plugin in Logstash
|
47
|
-
|
48
|
-
#### 2.1 Run in a local Logstash clone
|
49
|
-
|
50
|
-
- Edit Logstash `Gemfile` and add the local plugin path, for example:
|
9
|
+
The logstash-filter-memorize filter will look for fields from an event and record the last value
|
10
|
+
of them. If any are not present, their last value will be added to the
|
11
|
+
event. This is useful if you want to use data from a previous event
|
12
|
+
on future events (for example a time field or an id field). This differs
|
13
|
+
frome the multiline filter where you are combining multiple lines to
|
14
|
+
create a single event.
|
15
|
+
|
16
|
+
## Example
|
51
17
|
```ruby
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
56
|
-
|
18
|
+
if [message] =~ /Header:/ {
|
19
|
+
grok {
|
20
|
+
match => [ "message", "Header: %{WORD:headerField}" ]
|
21
|
+
}
|
22
|
+
}
|
23
|
+
# either save the datetime or add it based on last value
|
24
|
+
memorize {
|
25
|
+
field => 'headerField'
|
26
|
+
default => 'NOTFOUND'
|
27
|
+
}
|
28
|
+
# get rid of the header event since we don't want to do anything with it
|
29
|
+
if [message] =~ /Header:/) {
|
30
|
+
drop {}
|
31
|
+
}
|
32
|
+
|
33
|
+
# headerField is now present in the event
|
34
|
+
#... other filters here ...
|
57
35
|
```
|
58
|
-
- Run Logstash with your plugin
|
59
|
-
```sh
|
60
|
-
bin/logstash -e 'filter {awesome {}}'
|
61
|
-
```
|
62
|
-
At this point any modifications to the plugin code will be applied to this local Logstash setup. After modifying the plugin, simply rerun Logstash.
|
63
|
-
|
64
|
-
#### 2.2 Run in an installed Logstash
|
65
|
-
|
66
|
-
You can use the same **2.1** method to run your plugin in an installed Logstash by editing its `Gemfile` and pointing the `:path` to your local plugin development directory or you can build the gem and install it using:
|
67
|
-
|
68
|
-
- Build your plugin gem
|
69
|
-
```sh
|
70
|
-
gem build logstash-filter-awesome.gemspec
|
71
|
-
```
|
72
|
-
- Install the plugin from the Logstash home
|
73
|
-
```sh
|
74
|
-
bin/plugin install /your/local/plugin/logstash-filter-awesome.gem
|
75
|
-
```
|
76
|
-
- Start Logstash and proceed to test the plugin
|
77
|
-
|
78
|
-
## Contributing
|
79
|
-
|
80
|
-
All contributions are welcome: ideas, patches, documentation, bug reports, complaints, and even something you drew up on a napkin.
|
81
|
-
|
82
|
-
Programming is not a required skill. Whatever you've seen about open source and maintainers or community members saying "send patches or die" - you will not see that here.
|
83
|
-
|
84
|
-
It is more important to the community that you are able to contribute.
|
85
|
-
|
86
|
-
For more information about contributing, see the [CONTRIBUTING](https://github.com/elasticsearch/logstash/blob/master/CONTRIBUTING.md) file.
|
@@ -58,13 +58,13 @@ class LogStash::Filters::Memorize < LogStash::Filters::Base
|
|
58
58
|
any = false
|
59
59
|
key = event.sprintf(@stream_identity)
|
60
60
|
@fields.each do |field|
|
61
|
-
if event
|
61
|
+
if event.get(field).nil?
|
62
62
|
map = @memorized[key]
|
63
63
|
val = map.nil? ? nil : map[field]
|
64
64
|
if val.nil?
|
65
65
|
val = @default.nil? ? nil : @default[field]
|
66
66
|
else
|
67
|
-
event
|
67
|
+
event.set(field, val)
|
68
68
|
any = true
|
69
69
|
end
|
70
70
|
else
|
@@ -72,7 +72,7 @@ class LogStash::Filters::Memorize < LogStash::Filters::Base
|
|
72
72
|
if map.nil?
|
73
73
|
map = @memorized[key] = Hash.new
|
74
74
|
end
|
75
|
-
map[field] = event
|
75
|
+
map[field] = event.get(field)
|
76
76
|
end #if
|
77
77
|
if any
|
78
78
|
filter_matched(event)
|
@@ -1,6 +1,6 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
s.name = 'logstash-filter-memorize'
|
3
|
-
s.version = '0.
|
3
|
+
s.version = '1.0.0'
|
4
4
|
s.licenses = ['Apache License (2.0)']
|
5
5
|
s.summary = "The memorize filter is able to pick out details of an event and use that information in future events if it is not present."
|
6
6
|
s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
|
@@ -18,6 +18,6 @@ Gem::Specification.new do |s|
|
|
18
18
|
s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
|
19
19
|
|
20
20
|
# Gem dependencies
|
21
|
-
s.add_runtime_dependency "logstash-core", '>=
|
21
|
+
s.add_runtime_dependency "logstash-core", '>= 5.0.0', '< 6.0.0'
|
22
22
|
s.add_development_dependency 'logstash-devutils'
|
23
23
|
end
|
@@ -2,7 +2,7 @@ require 'spec_helper'
|
|
2
2
|
require "logstash/filters/memorize"
|
3
3
|
|
4
4
|
describe LogStash::Filters::Memorize do
|
5
|
-
describe "
|
5
|
+
describe "Captures id field" do
|
6
6
|
let(:config) do <<-CONFIG
|
7
7
|
filter {
|
8
8
|
memorize {
|
@@ -14,7 +14,7 @@ describe LogStash::Filters::Memorize do
|
|
14
14
|
|
15
15
|
sample("id" => "1") do
|
16
16
|
expect(subject).to include("id")
|
17
|
-
expect(subject
|
17
|
+
expect(subject.get('id')).to eq('1')
|
18
18
|
end
|
19
19
|
end
|
20
20
|
end
|
metadata
CHANGED
@@ -1,24 +1,24 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-memorize
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.
|
4
|
+
version: 1.0.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Adam Caldwell
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2016-
|
11
|
+
date: 2016-11-09 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|
15
15
|
requirements:
|
16
16
|
- - '>='
|
17
17
|
- !ruby/object:Gem::Version
|
18
|
-
version:
|
18
|
+
version: 5.0.0
|
19
19
|
- - <
|
20
20
|
- !ruby/object:Gem::Version
|
21
|
-
version:
|
21
|
+
version: 6.0.0
|
22
22
|
name: logstash-core
|
23
23
|
prerelease: false
|
24
24
|
type: :runtime
|
@@ -26,10 +26,10 @@ dependencies:
|
|
26
26
|
requirements:
|
27
27
|
- - '>='
|
28
28
|
- !ruby/object:Gem::Version
|
29
|
-
version:
|
29
|
+
version: 5.0.0
|
30
30
|
- - <
|
31
31
|
- !ruby/object:Gem::Version
|
32
|
-
version:
|
32
|
+
version: 6.0.0
|
33
33
|
- !ruby/object:Gem::Dependency
|
34
34
|
requirement: !ruby/object:Gem::Requirement
|
35
35
|
requirements:
|