logstash-filter-multiline 2.0.2 → 2.0.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +2 -0
- data/README.md +3 -0
- data/lib/logstash/filters/multiline.rb +7 -3
- data/logstash-filter-multiline.gemspec +2 -2
- data/spec/filters/multiline_spec.rb +43 -0
- metadata +24 -24
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: ead8a90af4e5b01350f6479e27f3a7edf4d910d1
|
4
|
+
data.tar.gz: f62946a7113fb0471d2c747c2f4b4d777b7d75f5
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: ecdc4ef014eab0fbf8d6572f89cafe4336184aa27fbf60ea205d79aca5ac14763b23fb08ff1dc9b52736577a66a6281e0755cba6b31afedde3b6745b33f1f12b
|
7
|
+
data.tar.gz: 889e41d684d1dd55a15ba7205a13f2b4a27264b79cd6d05ea829001ad4e9a1485a6589e3aefa57d7683808b9d2090b1cc70dc6f4bb25385370e2e78c58b83bb8
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,5 @@
|
|
1
|
+
## 2.0.3
|
2
|
+
- Fix metadata handling, fixes #19 and #22
|
1
3
|
## 2.0.0
|
2
4
|
- Plugins were updated to follow the new shutdown semantic, this mainly allows Logstash to instruct input plugins to terminate gracefully,
|
3
5
|
instead of using Thread.raise on the plugins' threads. Ref: https://github.com/elastic/logstash/pull/3895
|
data/README.md
CHANGED
@@ -1,5 +1,8 @@
|
|
1
1
|
# Logstash Plugin
|
2
2
|
|
3
|
+
[![Build
|
4
|
+
Status](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Filters/job/logstash-plugin-filter-multiline-unit/badge/icon)](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Filters/job/logstash-plugin-filter-multiline-unit/)
|
5
|
+
|
3
6
|
This is a plugin for [Logstash](https://github.com/elastic/logstash).
|
4
7
|
|
5
8
|
It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.
|
@@ -228,8 +228,10 @@ class LogStash::Filters::Multiline < LogStash::Filters::Base
|
|
228
228
|
# this line is not part of the previous event if we have a pending event, it's done, send it.
|
229
229
|
# put the current event into pending
|
230
230
|
unless pending.empty?
|
231
|
-
tmp
|
232
|
-
|
231
|
+
tmp = event.to_hash_with_metadata
|
232
|
+
merged_events = merge(pending)
|
233
|
+
event.overwrite(merged_events)
|
234
|
+
event["@metadata"] = merged_events["@metadata"] # Override does not copy the metadata
|
233
235
|
pending.clear # avoid array creation
|
234
236
|
pending << LogStash::Event.new(tmp)
|
235
237
|
else
|
@@ -253,7 +255,9 @@ class LogStash::Filters::Multiline < LogStash::Filters::Base
|
|
253
255
|
# if we have something in pending, join it with this message and send it.
|
254
256
|
# otherwise, this is a new message and not part of multiline, send it.
|
255
257
|
unless pending.empty?
|
256
|
-
|
258
|
+
merged_events = merge(pending << event)
|
259
|
+
event.overwrite(merged_events)
|
260
|
+
event["@metadata"] = merged_events["@metadata"] # Override does not copy the metadata
|
257
261
|
pending.clear
|
258
262
|
end
|
259
263
|
end # if match
|
@@ -1,7 +1,7 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-multiline'
|
4
|
-
s.version = '2.0.
|
4
|
+
s.version = '2.0.3'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "This filter will collapse multiline messages from a single source into one Logstash event."
|
7
7
|
s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
|
@@ -22,7 +22,7 @@ Gem::Specification.new do |s|
|
|
22
22
|
# Gem dependencies
|
23
23
|
s.add_runtime_dependency "logstash-core", ">= 2.0.0.beta2", "< 3.0.0"
|
24
24
|
s.add_runtime_dependency 'logstash-patterns-core'
|
25
|
-
s.
|
25
|
+
s.add_development_dependency 'logstash-filter-mutate'
|
26
26
|
s.add_runtime_dependency 'jls-grok', '~> 0.11.0'
|
27
27
|
|
28
28
|
s.add_development_dependency 'logstash-devutils'
|
@@ -245,4 +245,47 @@ describe LogStash::Filters::Multiline do
|
|
245
245
|
end
|
246
246
|
end
|
247
247
|
|
248
|
+
|
249
|
+
describe "keeps metadata fields after two consecutive non multline lines" do
|
250
|
+
config <<-CONFIG
|
251
|
+
filter {
|
252
|
+
mutate { add_field => { "[@metadata][index]" => "logstash-2015.11.19" } }
|
253
|
+
multiline {
|
254
|
+
pattern => "^%{NUMBER}"
|
255
|
+
what => "previous"
|
256
|
+
}
|
257
|
+
mutate { add_field => { "[@metadata][type]" => "foo" } }
|
258
|
+
}
|
259
|
+
CONFIG
|
260
|
+
|
261
|
+
sample ["line1", "line2"] do
|
262
|
+
expect(subject).to be_a(Array)
|
263
|
+
expect(subject[0]["@metadata"]).to include("index"=>"logstash-2015.11.19")
|
264
|
+
expect(subject[1]["@metadata"]).to include("index"=>"logstash-2015.11.19")
|
265
|
+
expect(subject[0]["@metadata"]).to include("type"=>"foo")
|
266
|
+
expect(subject[1]["@metadata"]).to include("type"=>"foo")
|
267
|
+
end
|
268
|
+
end
|
269
|
+
|
270
|
+
describe "keeps metadata fields after two consecutive non multline lines" do
|
271
|
+
config <<-CONFIG
|
272
|
+
filter {
|
273
|
+
mutate { add_field => { "[@metadata][index]" => "logstash-2015.11.19" } }
|
274
|
+
multiline {
|
275
|
+
pattern => "^%{NUMBER}"
|
276
|
+
what => "next"
|
277
|
+
}
|
278
|
+
mutate { add_field => { "[@metadata][type]" => "foo" } }
|
279
|
+
}
|
280
|
+
CONFIG
|
281
|
+
|
282
|
+
sample ["line1", "line2"] do
|
283
|
+
expect(subject).to be_a(Array)
|
284
|
+
expect(subject[0]["@metadata"]).to include("index"=>"logstash-2015.11.19")
|
285
|
+
expect(subject[1]["@metadata"]).to include("index"=>"logstash-2015.11.19")
|
286
|
+
expect(subject[0]["@metadata"]).to include("type"=>"foo")
|
287
|
+
expect(subject[1]["@metadata"]).to include("type"=>"foo")
|
288
|
+
end
|
289
|
+
end
|
290
|
+
|
248
291
|
end
|
metadata
CHANGED
@@ -1,17 +1,18 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-multiline
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 2.0.
|
4
|
+
version: 2.0.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2015-
|
11
|
+
date: 2015-11-26 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
|
-
|
14
|
+
name: logstash-core
|
15
|
+
version_requirements: !ruby/object:Gem::Requirement
|
15
16
|
requirements:
|
16
17
|
- - '>='
|
17
18
|
- !ruby/object:Gem::Version
|
@@ -19,10 +20,7 @@ dependencies:
|
|
19
20
|
- - <
|
20
21
|
- !ruby/object:Gem::Version
|
21
22
|
version: 3.0.0
|
22
|
-
|
23
|
-
prerelease: false
|
24
|
-
type: :runtime
|
25
|
-
version_requirements: !ruby/object:Gem::Requirement
|
23
|
+
requirement: !ruby/object:Gem::Requirement
|
26
24
|
requirements:
|
27
25
|
- - '>='
|
28
26
|
- !ruby/object:Gem::Version
|
@@ -30,62 +28,64 @@ dependencies:
|
|
30
28
|
- - <
|
31
29
|
- !ruby/object:Gem::Version
|
32
30
|
version: 3.0.0
|
31
|
+
prerelease: false
|
32
|
+
type: :runtime
|
33
33
|
- !ruby/object:Gem::Dependency
|
34
|
+
name: logstash-patterns-core
|
35
|
+
version_requirements: !ruby/object:Gem::Requirement
|
36
|
+
requirements:
|
37
|
+
- - '>='
|
38
|
+
- !ruby/object:Gem::Version
|
39
|
+
version: '0'
|
34
40
|
requirement: !ruby/object:Gem::Requirement
|
35
41
|
requirements:
|
36
42
|
- - '>='
|
37
43
|
- !ruby/object:Gem::Version
|
38
44
|
version: '0'
|
39
|
-
name: logstash-patterns-core
|
40
45
|
prerelease: false
|
41
46
|
type: :runtime
|
47
|
+
- !ruby/object:Gem::Dependency
|
48
|
+
name: logstash-filter-mutate
|
42
49
|
version_requirements: !ruby/object:Gem::Requirement
|
43
50
|
requirements:
|
44
51
|
- - '>='
|
45
52
|
- !ruby/object:Gem::Version
|
46
53
|
version: '0'
|
47
|
-
- !ruby/object:Gem::Dependency
|
48
54
|
requirement: !ruby/object:Gem::Requirement
|
49
55
|
requirements:
|
50
56
|
- - '>='
|
51
57
|
- !ruby/object:Gem::Version
|
52
58
|
version: '0'
|
53
|
-
name: logstash-filter-mutate
|
54
59
|
prerelease: false
|
55
|
-
type: :
|
60
|
+
type: :development
|
61
|
+
- !ruby/object:Gem::Dependency
|
62
|
+
name: jls-grok
|
56
63
|
version_requirements: !ruby/object:Gem::Requirement
|
57
64
|
requirements:
|
58
|
-
- -
|
65
|
+
- - ~>
|
59
66
|
- !ruby/object:Gem::Version
|
60
|
-
version:
|
61
|
-
- !ruby/object:Gem::Dependency
|
67
|
+
version: 0.11.0
|
62
68
|
requirement: !ruby/object:Gem::Requirement
|
63
69
|
requirements:
|
64
70
|
- - ~>
|
65
71
|
- !ruby/object:Gem::Version
|
66
72
|
version: 0.11.0
|
67
|
-
name: jls-grok
|
68
73
|
prerelease: false
|
69
74
|
type: :runtime
|
75
|
+
- !ruby/object:Gem::Dependency
|
76
|
+
name: logstash-devutils
|
70
77
|
version_requirements: !ruby/object:Gem::Requirement
|
71
78
|
requirements:
|
72
|
-
- -
|
79
|
+
- - '>='
|
73
80
|
- !ruby/object:Gem::Version
|
74
|
-
version: 0
|
75
|
-
- !ruby/object:Gem::Dependency
|
81
|
+
version: '0'
|
76
82
|
requirement: !ruby/object:Gem::Requirement
|
77
83
|
requirements:
|
78
84
|
- - '>='
|
79
85
|
- !ruby/object:Gem::Version
|
80
86
|
version: '0'
|
81
|
-
name: logstash-devutils
|
82
87
|
prerelease: false
|
83
88
|
type: :development
|
84
|
-
version_requirements: !ruby/object:Gem::Requirement
|
85
|
-
requirements:
|
86
|
-
- - '>='
|
87
|
-
- !ruby/object:Gem::Version
|
88
|
-
version: '0'
|
89
89
|
description: This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program
|
90
90
|
email: info@elastic.co
|
91
91
|
executables: []
|