logstash-filter-multiline 2.0.5 → 3.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +2 -0
- data/Gemfile +3 -1
- data/LICENSE +1 -1
- data/README.md +12 -3
- data/lib/logstash/filters/multiline.rb +5 -7
- data/logstash-filter-multiline.gemspec +4 -4
- data/spec/filters/multiline_spec.rb +28 -28
- metadata +32 -29
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: ed2f76cf601f2f8f263288c27f38e52f2b5ec28f
|
4
|
+
data.tar.gz: 5d4a58a07ad04120b05d337215edc6210cdf3308
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 38995d4ec870df55106bc52230e16eeb3d08f213e6961e7fed0c7cac0a449560e061e8a7b8bb6284ea04b7cb1e9c18b3178a5a555d5961adf310ac17cd974dd9
|
7
|
+
data.tar.gz: e681f7c127697c711032a208f835a0262ec325990943faa3650b9d5501b2e0fc21ba6ca619ee34b297732ba893e6331951efb03658232ca50495d3f031ea21a2
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,5 @@
|
|
1
|
+
## 3.0.0
|
2
|
+
- Update the plugin to the version 2.0 of the plugin api, this change is required for Logstash 5.0 compatibility. See https://github.com/elastic/logstash/issues/5141
|
1
3
|
# 2.0.5
|
2
4
|
- Depend on logstash-core-plugin-api instead of logstash-core, removing the need to mass update plugins on major releases of logstash
|
3
5
|
# 2.0.4
|
data/Gemfile
CHANGED
data/LICENSE
CHANGED
data/README.md
CHANGED
@@ -1,7 +1,6 @@
|
|
1
1
|
# Logstash Plugin
|
2
2
|
|
3
|
-
[](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Filters/job/logstash-plugin-filter-multiline-unit/)
|
3
|
+
[](https://travis-ci.org/logstash-plugins/logstash-filter-multiline)
|
5
4
|
|
6
5
|
This is a plugin for [Logstash](https://github.com/elastic/logstash).
|
7
6
|
|
@@ -56,7 +55,12 @@ gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
|
|
56
55
|
```
|
57
56
|
- Install plugin
|
58
57
|
```sh
|
58
|
+
# Logstash 2.3 and higher
|
59
|
+
bin/logstash-plugin install --no-verify
|
60
|
+
|
61
|
+
# Prior to Logstash 2.3
|
59
62
|
bin/plugin install --no-verify
|
63
|
+
|
60
64
|
```
|
61
65
|
- Run Logstash with your plugin
|
62
66
|
```sh
|
@@ -74,7 +78,12 @@ gem build logstash-filter-awesome.gemspec
|
|
74
78
|
```
|
75
79
|
- Install the plugin from the Logstash home
|
76
80
|
```sh
|
77
|
-
|
81
|
+
# Logstash 2.3 and higher
|
82
|
+
bin/logstash-plugin install --no-verify
|
83
|
+
|
84
|
+
# Prior to Logstash 2.3
|
85
|
+
bin/plugin install --no-verify
|
86
|
+
|
78
87
|
```
|
79
88
|
- Start Logstash and proceed to test the plugin
|
80
89
|
|
@@ -165,12 +165,10 @@ class LogStash::Filters::Multiline < LogStash::Filters::Base
|
|
165
165
|
|
166
166
|
public
|
167
167
|
def filter(event)
|
168
|
-
|
169
|
-
|
170
|
-
match = event[@source].is_a?(Array) ? @grok.match(event[@source].first) : @grok.match(event[@source])
|
168
|
+
match = event.get(@source).is_a?(Array) ? @grok.match(event.get(@source).first) : @grok.match(event.get(@source))
|
171
169
|
match = (match && !@negate) || (!match && @negate) # add negate option
|
172
170
|
|
173
|
-
@logger.debug? && @logger.debug("Multiline", :pattern => @pattern, :message => event
|
171
|
+
@logger.debug? && @logger.debug("Multiline", :pattern => @pattern, :message => event.get(@source), :match => match, :negate => @negate)
|
174
172
|
|
175
173
|
multiline_filter!(event, match)
|
176
174
|
|
@@ -192,7 +190,7 @@ class LogStash::Filters::Multiline < LogStash::Filters::Base
|
|
192
190
|
# if :final flush then select all events
|
193
191
|
expired = @pending.inject({}) do |result, (key, events)|
|
194
192
|
unless events.empty?
|
195
|
-
age = Time.now - events.first
|
193
|
+
age = Time.now - events.first.get("@timestamp").time
|
196
194
|
result[key] = events if (age >= @max_age) || options[:final]
|
197
195
|
end
|
198
196
|
result
|
@@ -231,7 +229,7 @@ class LogStash::Filters::Multiline < LogStash::Filters::Base
|
|
231
229
|
tmp = event.to_hash_with_metadata
|
232
230
|
merged_events = merge(pending)
|
233
231
|
event.overwrite(merged_events)
|
234
|
-
event
|
232
|
+
event.set("@metadata", merged_events.get("@metadata")) # Override does not copy the metadata
|
235
233
|
pending.clear # avoid array creation
|
236
234
|
pending << LogStash::Event.new(tmp)
|
237
235
|
else
|
@@ -257,7 +255,7 @@ class LogStash::Filters::Multiline < LogStash::Filters::Base
|
|
257
255
|
unless pending.empty?
|
258
256
|
merged_events = merge(pending << event)
|
259
257
|
event.overwrite(merged_events)
|
260
|
-
event
|
258
|
+
event.set("@metadata", merged_events.get("@metadata")) # Override does not copy the metadata
|
261
259
|
pending.clear
|
262
260
|
end
|
263
261
|
end # if match
|
@@ -1,10 +1,10 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-multiline'
|
4
|
-
s.version = '
|
4
|
+
s.version = '3.0.0'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "This filter will collapse multiline messages from a single source into one Logstash event."
|
7
|
-
s.description = "This gem is a
|
7
|
+
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
8
8
|
s.authors = ["Elastic"]
|
9
9
|
s.email = 'info@elastic.co'
|
10
10
|
s.homepage = "http://www.elastic.co/guide/en/logstash/current/index.html"
|
@@ -20,11 +20,11 @@ Gem::Specification.new do |s|
|
|
20
20
|
s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
|
21
21
|
|
22
22
|
# Gem dependencies
|
23
|
-
s.add_runtime_dependency "logstash-core-plugin-api", "~>
|
23
|
+
s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
|
24
24
|
s.add_runtime_dependency 'logstash-patterns-core'
|
25
|
-
s.add_development_dependency 'logstash-filter-mutate'
|
26
25
|
s.add_runtime_dependency 'jls-grok', '~> 0.11.0'
|
27
26
|
|
27
|
+
s.add_development_dependency 'logstash-filter-mutate'
|
28
28
|
s.add_development_dependency 'logstash-devutils'
|
29
29
|
end
|
30
30
|
|
@@ -19,8 +19,8 @@ describe LogStash::Filters::Multiline do
|
|
19
19
|
sample [ "hello world", " second line", "another first line" ] do
|
20
20
|
expect(subject).to be_a(Array)
|
21
21
|
insist { subject.size } == 2
|
22
|
-
insist { subject[0]
|
23
|
-
insist { subject[1]
|
22
|
+
insist { subject[0].get("message") } == "hello world\n second line"
|
23
|
+
insist { subject[1].get("message") } == "another first line"
|
24
24
|
end
|
25
25
|
end
|
26
26
|
|
@@ -36,7 +36,7 @@ describe LogStash::Filters::Multiline do
|
|
36
36
|
CONFIG
|
37
37
|
|
38
38
|
sample [ "120913 12:04:33 first line", "second line", "third line" ] do
|
39
|
-
insist { subject
|
39
|
+
insist { subject.get("message") } == "120913 12:04:33 first line\nsecond line\nthird line"
|
40
40
|
end
|
41
41
|
end
|
42
42
|
|
@@ -79,10 +79,10 @@ describe LogStash::Filters::Multiline do
|
|
79
79
|
insist { subject.size } == count
|
80
80
|
|
81
81
|
subject.each_with_index do |event, i|
|
82
|
-
insist { event
|
83
|
-
stream = event
|
84
|
-
insist { event
|
85
|
-
insist { event
|
82
|
+
insist { event.get("type") == event.get("host") } == true
|
83
|
+
stream = event.get("type")
|
84
|
+
insist { event.get("message").split("\n").first } =~ /hello world /
|
85
|
+
insist { event.get("message").scan(/stream\d/).all?{|word| word == stream} } == true
|
86
86
|
end
|
87
87
|
end
|
88
88
|
end
|
@@ -109,8 +109,8 @@ describe LogStash::Filters::Multiline do
|
|
109
109
|
insist { subject.size } == 2
|
110
110
|
|
111
111
|
subject.each do |s|
|
112
|
-
insist { s
|
113
|
-
insist { s
|
112
|
+
insist { s.get("tags").include?("nope") } == true
|
113
|
+
insist { s.get("tags").include?("dummy") } == false
|
114
114
|
insist { s.include?("dummy2") } == true
|
115
115
|
end
|
116
116
|
end
|
@@ -128,7 +128,7 @@ describe LogStash::Filters::Multiline do
|
|
128
128
|
|
129
129
|
sample [ " match", "nomatch" ] do
|
130
130
|
expect(subject).to be_a(LogStash::Event)
|
131
|
-
insist { subject
|
131
|
+
insist { subject.get("message") } == " match\nnomatch"
|
132
132
|
end
|
133
133
|
end
|
134
134
|
|
@@ -145,8 +145,8 @@ describe LogStash::Filters::Multiline do
|
|
145
145
|
sample [" match1", "nomatch1", " match2", "nomatch2"] do
|
146
146
|
expect(subject).to be_a(Array)
|
147
147
|
insist { subject.size } == 2
|
148
|
-
insist { subject[0]
|
149
|
-
insist { subject[1]
|
148
|
+
insist { subject[0].get("message") } == " match1\nnomatch1"
|
149
|
+
insist { subject[1].get("message") } == " match2\nnomatch2"
|
150
150
|
end
|
151
151
|
end
|
152
152
|
|
@@ -163,8 +163,8 @@ describe LogStash::Filters::Multiline do
|
|
163
163
|
sample [" match1", " match1", "nomatch1", " 1match2", " 2match2", " 1match2", "nomatch2"] do
|
164
164
|
expect(subject).to be_a(Array)
|
165
165
|
insist { subject.size } == 2
|
166
|
-
insist { subject[0]
|
167
|
-
insist { subject[1]
|
166
|
+
insist { subject[0].get("message") } == " match1\n match1\nnomatch1"
|
167
|
+
insist { subject[1].get("message") } == " 1match2\n 2match2\n 1match2\nnomatch2"
|
168
168
|
end
|
169
169
|
end
|
170
170
|
|
@@ -182,8 +182,8 @@ describe LogStash::Filters::Multiline do
|
|
182
182
|
sample [" match1", " match1", "nomatch1", " 1match2", " 2match2", " 1match2", "nomatch2"] do
|
183
183
|
expect(subject).to be_a(Array)
|
184
184
|
insist { subject.size } == 2
|
185
|
-
insist { subject[0]
|
186
|
-
insist { subject[1]
|
185
|
+
insist { subject[0].get("message") } == " match1\nnomatch1"
|
186
|
+
insist { subject[1].get("message") } == " 1match2\n 2match2\nnomatch2"
|
187
187
|
end
|
188
188
|
end
|
189
189
|
|
@@ -209,9 +209,9 @@ describe LogStash::Filters::Multiline do
|
|
209
209
|
] do
|
210
210
|
expect(subject).to be_a(Array)
|
211
211
|
insist { subject.size } == 2
|
212
|
-
insist { subject[0]
|
213
|
-
insist { subject[0]
|
214
|
-
insist { subject[1]
|
212
|
+
insist { subject[0].get("foo") } == " match1\n match1\nnomatch1"
|
213
|
+
insist { subject[0].get("message") } == ["bar", "baz"]
|
214
|
+
insist { subject[1].get("foo") } == " 1match2\n 2match2\n 1match2\nnomatch2"
|
215
215
|
end
|
216
216
|
end
|
217
217
|
|
@@ -241,7 +241,7 @@ describe LogStash::Filters::Multiline do
|
|
241
241
|
sample messages do
|
242
242
|
expect(subject).to be_a(Array)
|
243
243
|
insist { subject.size } == 2
|
244
|
-
insist { subject[0]
|
244
|
+
insist { subject[0].get("message") } == messages[0..-2].join("\n")
|
245
245
|
end
|
246
246
|
end
|
247
247
|
|
@@ -260,10 +260,10 @@ describe LogStash::Filters::Multiline do
|
|
260
260
|
|
261
261
|
sample ["line1", "line2"] do
|
262
262
|
expect(subject).to be_a(Array)
|
263
|
-
expect(subject[0]
|
264
|
-
expect(subject[1]
|
265
|
-
expect(subject[0]
|
266
|
-
expect(subject[1]
|
263
|
+
expect(subject[0].get("@metadata")).to include("index"=>"logstash-2015.11.19")
|
264
|
+
expect(subject[1].get("@metadata")).to include("index"=>"logstash-2015.11.19")
|
265
|
+
expect(subject[0].get("@metadata")).to include("type"=>"foo")
|
266
|
+
expect(subject[1].get("@metadata")).to include("type"=>"foo")
|
267
267
|
end
|
268
268
|
end
|
269
269
|
|
@@ -281,10 +281,10 @@ describe LogStash::Filters::Multiline do
|
|
281
281
|
|
282
282
|
sample ["line1", "line2"] do
|
283
283
|
expect(subject).to be_a(Array)
|
284
|
-
expect(subject[0]
|
285
|
-
expect(subject[1]
|
286
|
-
expect(subject[0]
|
287
|
-
expect(subject[1]
|
284
|
+
expect(subject[0].get("@metadata")).to include("index"=>"logstash-2015.11.19")
|
285
|
+
expect(subject[1].get("@metadata")).to include("index"=>"logstash-2015.11.19")
|
286
|
+
expect(subject[0].get("@metadata")).to include("type"=>"foo")
|
287
|
+
expect(subject[1].get("@metadata")).to include("type"=>"foo")
|
288
288
|
end
|
289
289
|
end
|
290
290
|
|
metadata
CHANGED
@@ -1,86 +1,88 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-multiline
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 3.0.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
|
-
autorequire:
|
8
|
+
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2016-
|
11
|
+
date: 2016-05-06 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
|
+
name: logstash-core-plugin-api
|
14
15
|
requirement: !ruby/object:Gem::Requirement
|
15
16
|
requirements:
|
16
17
|
- - "~>"
|
17
18
|
- !ruby/object:Gem::Version
|
18
|
-
version: '
|
19
|
-
name: logstash-core-plugin-api
|
20
|
-
prerelease: false
|
19
|
+
version: '2.0'
|
21
20
|
type: :runtime
|
21
|
+
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - "~>"
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: '
|
26
|
+
version: '2.0'
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
|
+
name: logstash-patterns-core
|
28
29
|
requirement: !ruby/object:Gem::Requirement
|
29
30
|
requirements:
|
30
31
|
- - ">="
|
31
32
|
- !ruby/object:Gem::Version
|
32
33
|
version: '0'
|
33
|
-
name: logstash-patterns-core
|
34
|
-
prerelease: false
|
35
34
|
type: :runtime
|
35
|
+
prerelease: false
|
36
36
|
version_requirements: !ruby/object:Gem::Requirement
|
37
37
|
requirements:
|
38
38
|
- - ">="
|
39
39
|
- !ruby/object:Gem::Version
|
40
40
|
version: '0'
|
41
41
|
- !ruby/object:Gem::Dependency
|
42
|
+
name: jls-grok
|
42
43
|
requirement: !ruby/object:Gem::Requirement
|
43
44
|
requirements:
|
44
|
-
- - "
|
45
|
+
- - "~>"
|
45
46
|
- !ruby/object:Gem::Version
|
46
|
-
version:
|
47
|
-
|
47
|
+
version: 0.11.0
|
48
|
+
type: :runtime
|
48
49
|
prerelease: false
|
49
|
-
type: :development
|
50
50
|
version_requirements: !ruby/object:Gem::Requirement
|
51
51
|
requirements:
|
52
|
-
- - "
|
52
|
+
- - "~>"
|
53
53
|
- !ruby/object:Gem::Version
|
54
|
-
version:
|
54
|
+
version: 0.11.0
|
55
55
|
- !ruby/object:Gem::Dependency
|
56
|
+
name: logstash-filter-mutate
|
56
57
|
requirement: !ruby/object:Gem::Requirement
|
57
58
|
requirements:
|
58
|
-
- - "
|
59
|
+
- - ">="
|
59
60
|
- !ruby/object:Gem::Version
|
60
|
-
version: 0
|
61
|
-
|
61
|
+
version: '0'
|
62
|
+
type: :development
|
62
63
|
prerelease: false
|
63
|
-
type: :runtime
|
64
64
|
version_requirements: !ruby/object:Gem::Requirement
|
65
65
|
requirements:
|
66
|
-
- - "
|
66
|
+
- - ">="
|
67
67
|
- !ruby/object:Gem::Version
|
68
|
-
version: 0
|
68
|
+
version: '0'
|
69
69
|
- !ruby/object:Gem::Dependency
|
70
|
+
name: logstash-devutils
|
70
71
|
requirement: !ruby/object:Gem::Requirement
|
71
72
|
requirements:
|
72
73
|
- - ">="
|
73
74
|
- !ruby/object:Gem::Version
|
74
75
|
version: '0'
|
75
|
-
name: logstash-devutils
|
76
|
-
prerelease: false
|
77
76
|
type: :development
|
77
|
+
prerelease: false
|
78
78
|
version_requirements: !ruby/object:Gem::Requirement
|
79
79
|
requirements:
|
80
80
|
- - ">="
|
81
81
|
- !ruby/object:Gem::Version
|
82
82
|
version: '0'
|
83
|
-
description: This gem is a
|
83
|
+
description: This gem is a Logstash plugin required to be installed on top of the
|
84
|
+
Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
|
85
|
+
gem is not a stand-alone program
|
84
86
|
email: info@elastic.co
|
85
87
|
executables: []
|
86
88
|
extensions: []
|
@@ -101,7 +103,7 @@ licenses:
|
|
101
103
|
metadata:
|
102
104
|
logstash_plugin: 'true'
|
103
105
|
logstash_group: filter
|
104
|
-
post_install_message:
|
106
|
+
post_install_message:
|
105
107
|
rdoc_options: []
|
106
108
|
require_paths:
|
107
109
|
- lib
|
@@ -116,10 +118,11 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
116
118
|
- !ruby/object:Gem::Version
|
117
119
|
version: '0'
|
118
120
|
requirements: []
|
119
|
-
rubyforge_project:
|
120
|
-
rubygems_version: 2.
|
121
|
-
signing_key:
|
121
|
+
rubyforge_project:
|
122
|
+
rubygems_version: 2.5.1
|
123
|
+
signing_key:
|
122
124
|
specification_version: 4
|
123
|
-
summary: This filter will collapse multiline messages from a single source into one
|
125
|
+
summary: This filter will collapse multiline messages from a single source into one
|
126
|
+
Logstash event.
|
124
127
|
test_files:
|
125
128
|
- spec/filters/multiline_spec.rb
|