logstash-filter-memorize 0.9.2 → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.gitignore +1 -0
- data/README.md +25 -76
- data/lib/logstash/filters/memorize.rb +3 -3
- data/logstash-filter-memorize.gemspec +2 -2
- data/spec/filters/memorize_spec.rb +2 -2
- metadata +6 -6
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 5e3b24f20c11a391d6c477292111a5fc69b44568
|
4
|
+
data.tar.gz: aee862428ac8329c7680c24ee60eeb03d799c6bb
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: a759eedd6547c60a05950917aa4ede460b5dac332499bf2dddf5cddc3b7392412aa950741e1ca31f6a9d5556e37e0065b097ccdd183b2aa8c66ce2dfb476fc96
|
7
|
+
data.tar.gz: 3d1b5f6001a2a18ea857123b3cced4b38d45ff4b307478486a65ae20d282698338a6f28cfd2a858587824204367fed974a55f6091b1f7f63706472f35333559c
|
data/.gitignore
CHANGED
data/README.md
CHANGED
@@ -6,81 +6,30 @@ It is fully free and fully open source. The license is Apache 2.0, meaning you a
|
|
6
6
|
|
7
7
|
## Documentation
|
8
8
|
|
9
|
-
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
## Developing
|
19
|
-
|
20
|
-
### 1. Plugin Developement and Testing
|
21
|
-
|
22
|
-
#### Code
|
23
|
-
- To get started, you'll need JRuby with the Bundler gem installed.
|
24
|
-
|
25
|
-
- Create a new plugin or clone and existing from the GitHub [logstash-plugins](https://github.com/logstash-plugins) organization. We also provide [example plugins](https://github.com/logstash-plugins?query=example).
|
26
|
-
|
27
|
-
- Install dependencies
|
28
|
-
```sh
|
29
|
-
bundle install
|
30
|
-
```
|
31
|
-
|
32
|
-
#### Test
|
33
|
-
|
34
|
-
- Update your dependencies
|
35
|
-
|
36
|
-
```sh
|
37
|
-
bundle install
|
38
|
-
```
|
39
|
-
|
40
|
-
- Run tests
|
41
|
-
|
42
|
-
```sh
|
43
|
-
bundle exec rspec
|
44
|
-
```
|
45
|
-
|
46
|
-
### 2. Running your unpublished Plugin in Logstash
|
47
|
-
|
48
|
-
#### 2.1 Run in a local Logstash clone
|
49
|
-
|
50
|
-
- Edit Logstash `Gemfile` and add the local plugin path, for example:
|
9
|
+
The logstash-filter-memorize filter will look for fields from an event and record the last value
|
10
|
+
of them. If any are not present, their last value will be added to the
|
11
|
+
event. This is useful if you want to use data from a previous event
|
12
|
+
on future events (for example a time field or an id field). This differs
|
13
|
+
frome the multiline filter where you are combining multiple lines to
|
14
|
+
create a single event.
|
15
|
+
|
16
|
+
## Example
|
51
17
|
```ruby
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
56
|
-
|
18
|
+
if [message] =~ /Header:/ {
|
19
|
+
grok {
|
20
|
+
match => [ "message", "Header: %{WORD:headerField}" ]
|
21
|
+
}
|
22
|
+
}
|
23
|
+
# either save the datetime or add it based on last value
|
24
|
+
memorize {
|
25
|
+
field => 'headerField'
|
26
|
+
default => 'NOTFOUND'
|
27
|
+
}
|
28
|
+
# get rid of the header event since we don't want to do anything with it
|
29
|
+
if [message] =~ /Header:/) {
|
30
|
+
drop {}
|
31
|
+
}
|
32
|
+
|
33
|
+
# headerField is now present in the event
|
34
|
+
#... other filters here ...
|
57
35
|
```
|
58
|
-
- Run Logstash with your plugin
|
59
|
-
```sh
|
60
|
-
bin/logstash -e 'filter {awesome {}}'
|
61
|
-
```
|
62
|
-
At this point any modifications to the plugin code will be applied to this local Logstash setup. After modifying the plugin, simply rerun Logstash.
|
63
|
-
|
64
|
-
#### 2.2 Run in an installed Logstash
|
65
|
-
|
66
|
-
You can use the same **2.1** method to run your plugin in an installed Logstash by editing its `Gemfile` and pointing the `:path` to your local plugin development directory or you can build the gem and install it using:
|
67
|
-
|
68
|
-
- Build your plugin gem
|
69
|
-
```sh
|
70
|
-
gem build logstash-filter-awesome.gemspec
|
71
|
-
```
|
72
|
-
- Install the plugin from the Logstash home
|
73
|
-
```sh
|
74
|
-
bin/plugin install /your/local/plugin/logstash-filter-awesome.gem
|
75
|
-
```
|
76
|
-
- Start Logstash and proceed to test the plugin
|
77
|
-
|
78
|
-
## Contributing
|
79
|
-
|
80
|
-
All contributions are welcome: ideas, patches, documentation, bug reports, complaints, and even something you drew up on a napkin.
|
81
|
-
|
82
|
-
Programming is not a required skill. Whatever you've seen about open source and maintainers or community members saying "send patches or die" - you will not see that here.
|
83
|
-
|
84
|
-
It is more important to the community that you are able to contribute.
|
85
|
-
|
86
|
-
For more information about contributing, see the [CONTRIBUTING](https://github.com/elasticsearch/logstash/blob/master/CONTRIBUTING.md) file.
|
@@ -58,13 +58,13 @@ class LogStash::Filters::Memorize < LogStash::Filters::Base
|
|
58
58
|
any = false
|
59
59
|
key = event.sprintf(@stream_identity)
|
60
60
|
@fields.each do |field|
|
61
|
-
if event
|
61
|
+
if event.get(field).nil?
|
62
62
|
map = @memorized[key]
|
63
63
|
val = map.nil? ? nil : map[field]
|
64
64
|
if val.nil?
|
65
65
|
val = @default.nil? ? nil : @default[field]
|
66
66
|
else
|
67
|
-
event
|
67
|
+
event.set(field, val)
|
68
68
|
any = true
|
69
69
|
end
|
70
70
|
else
|
@@ -72,7 +72,7 @@ class LogStash::Filters::Memorize < LogStash::Filters::Base
|
|
72
72
|
if map.nil?
|
73
73
|
map = @memorized[key] = Hash.new
|
74
74
|
end
|
75
|
-
map[field] = event
|
75
|
+
map[field] = event.get(field)
|
76
76
|
end #if
|
77
77
|
if any
|
78
78
|
filter_matched(event)
|
@@ -1,6 +1,6 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
s.name = 'logstash-filter-memorize'
|
3
|
-
s.version = '0.
|
3
|
+
s.version = '1.0.0'
|
4
4
|
s.licenses = ['Apache License (2.0)']
|
5
5
|
s.summary = "The memorize filter is able to pick out details of an event and use that information in future events if it is not present."
|
6
6
|
s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
|
@@ -18,6 +18,6 @@ Gem::Specification.new do |s|
|
|
18
18
|
s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
|
19
19
|
|
20
20
|
# Gem dependencies
|
21
|
-
s.add_runtime_dependency "logstash-core", '>=
|
21
|
+
s.add_runtime_dependency "logstash-core", '>= 5.0.0', '< 6.0.0'
|
22
22
|
s.add_development_dependency 'logstash-devutils'
|
23
23
|
end
|
@@ -2,7 +2,7 @@ require 'spec_helper'
|
|
2
2
|
require "logstash/filters/memorize"
|
3
3
|
|
4
4
|
describe LogStash::Filters::Memorize do
|
5
|
-
describe "
|
5
|
+
describe "Captures id field" do
|
6
6
|
let(:config) do <<-CONFIG
|
7
7
|
filter {
|
8
8
|
memorize {
|
@@ -14,7 +14,7 @@ describe LogStash::Filters::Memorize do
|
|
14
14
|
|
15
15
|
sample("id" => "1") do
|
16
16
|
expect(subject).to include("id")
|
17
|
-
expect(subject
|
17
|
+
expect(subject.get('id')).to eq('1')
|
18
18
|
end
|
19
19
|
end
|
20
20
|
end
|
metadata
CHANGED
@@ -1,24 +1,24 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-memorize
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.
|
4
|
+
version: 1.0.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Adam Caldwell
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2016-
|
11
|
+
date: 2016-11-09 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|
15
15
|
requirements:
|
16
16
|
- - '>='
|
17
17
|
- !ruby/object:Gem::Version
|
18
|
-
version:
|
18
|
+
version: 5.0.0
|
19
19
|
- - <
|
20
20
|
- !ruby/object:Gem::Version
|
21
|
-
version:
|
21
|
+
version: 6.0.0
|
22
22
|
name: logstash-core
|
23
23
|
prerelease: false
|
24
24
|
type: :runtime
|
@@ -26,10 +26,10 @@ dependencies:
|
|
26
26
|
requirements:
|
27
27
|
- - '>='
|
28
28
|
- !ruby/object:Gem::Version
|
29
|
-
version:
|
29
|
+
version: 5.0.0
|
30
30
|
- - <
|
31
31
|
- !ruby/object:Gem::Version
|
32
|
-
version:
|
32
|
+
version: 6.0.0
|
33
33
|
- !ruby/object:Gem::Dependency
|
34
34
|
requirement: !ruby/object:Gem::Requirement
|
35
35
|
requirements:
|