logstash-filter-multiline 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 17b100c6051b6ad4550f98ae38ff0bc2d4409264
-  data.tar.gz: 35c2238c3f6de3bd6dabe93787e1f4c248bd22ea
+  metadata.gz: df182f44556a48d76c7f81b2f17c48ea58e5b561
+  data.tar.gz: 88a66ec2683dc519251713821db75d76c8a26f57
 SHA512:
-  metadata.gz: 0dbbeba706eb2f5e58d2273000efebedbf1f0b7e357bf01b0c3651409cd5b8b52cb57b47b333a71f51f224d21e96bd045ad1ce7a1a32d9913da6bed80bc5a9ef
-  data.tar.gz: b802811b07e7ea7a2b906782e6759c289fa2f712f55c3eb77338e18e2f16972edcdfa68be817a8652adba0ea5526765f2781d68aa3d25d606f6d14b1e33d2f91
+  metadata.gz: 0221738244d7cf9ce35954fcfd90c0efddd861e84258203d4b35e6674187de9ccd02321d74c9022d2fff9c998867799a749414c5449b7dda5cdbca0076cbc350
+  data.tar.gz: c343454ea138b676862b5e5fb05befffd8db3ebcf5561c438af440161c78b0e98afdd7c35dea7dab77fab6d983ef6e461b73853f05e21f15ac3846662621b71a

data/CHANGELOG.md

@@ -0,0 +1,2 @@
+## 1.1.0
+ - Fix metadata handling, fixes #19 and #22

data/Gemfile

@@ -1,2 +1,2 @@
 source 'https://rubygems.org'
-gemspec
+gemspec

data/README.md

@@ -1,15 +1,15 @@
 # Logstash Plugin
 
-This is a plugin for [Logstash](https://github.com/elasticsearch/logstash).
+This is a plugin for [Logstash](https://github.com/elastic/logstash).
 
 It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.
 
 ## Documentation
 
-Logstash provides infrastructure to automatically generate documentation for this plugin. We use the asciidoc format to write documentation so any comments in the source code will be first converted into asciidoc and then into html. All plugin documentation are placed under one [central location](http://www.elasticsearch.org/guide/en/logstash/current/).
+Logstash provides infrastructure to automatically generate documentation for this plugin. We use the asciidoc format to write documentation so any comments in the source code will be first converted into asciidoc and then into html. All plugin documentation are placed under one [central location](http://www.elastic.co/guide/en/logstash/current/).
 
 - For formatting code or config example, you can use the asciidoc `[source,ruby]` directive
-- For more asciidoc formatting tips, see the excellent reference here https://github.com/elasticsearch/docs#asciidoc-guide
+- For more asciidoc formatting tips, see the excellent reference here https://github.com/elastic/docs#asciidoc-guide
 
 ## Need Help?
 
@@ -83,4 +83,4 @@ Programming is not a required skill. Whatever you've seen about open source and
 
 It is more important to the community that you are able to contribute.
 
-For more information about contributing, see the [CONTRIBUTING](https://github.com/elasticsearch/logstash/blob/master/CONTRIBUTING.md) file.
+For more information about contributing, see the [CONTRIBUTING](https://github.com/elastic/logstash/blob/master/CONTRIBUTING.md) file.

data/lib/logstash/filters/multiline.rb

@@ -228,8 +228,10 @@ class LogStash::Filters::Multiline < LogStash::Filters::Base
       # this line is not part of the previous event if we have a pending event, it's done, send it.
       # put the current event into pending
       unless pending.empty?
-        tmp = event.to_hash
-        event.overwrite(merge(pending))
+        tmp           = event.to_hash_with_metadata
+        merged_events = merge(pending)
+        event.overwrite(merged_events)
+        event["@metadata"] = merged_events["@metadata"] # Override does not copy the metadata
         pending.clear # avoid array creation
         pending << LogStash::Event.new(tmp)
       else
@@ -253,7 +255,9 @@ class LogStash::Filters::Multiline < LogStash::Filters::Base
       # if we have something in pending, join it with this message and send it.
       # otherwise, this is a new message and not part of multiline, send it.
       unless pending.empty?
-        event.overwrite(merge(pending << event))
+        merged_events = merge(pending << event)
+        event.overwrite(merged_events)
+        event["@metadata"] = merged_events["@metadata"] # Override does not copy the metadata
         pending.clear
       end
     end # if match

data/logstash-filter-multiline.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-multiline'
-  s.version         = '1.0.0'
+  s.version         = '1.1.0'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "This filter will collapse multiline messages from a single source into one Logstash event."
   s.description     = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
@@ -20,7 +20,7 @@ Gem::Specification.new do |s|
   s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
 
   # Gem dependencies
-  s.add_runtime_dependency "logstash-core", '>= 1.4.0', '< 2.0.0'
+  s.add_runtime_dependency "logstash-core", '>= 1.4.0', '< 2.0.0.alpha0'
   s.add_runtime_dependency 'logstash-patterns-core'
   s.add_runtime_dependency 'logstash-filter-mutate'
   s.add_runtime_dependency 'jls-grok', '~> 0.11.0'

data/spec/filters/multiline_spec.rb

@@ -245,4 +245,47 @@ describe LogStash::Filters::Multiline do
     end
   end
 
+
+  describe "keeps metadata fields after two consecutive non multline lines" do
+    config <<-CONFIG
+    filter {
+       mutate { add_field => { "[@metadata][index]" => "logstash-2015.11.19" } }
+       multiline {
+          pattern => "^%{NUMBER}"
+          what => "previous"
+      }
+       mutate { add_field => { "[@metadata][type]" => "foo" } }
+    }
+    CONFIG
+
+    sample ["line1", "line2"] do
+      expect(subject).to be_a(Array)
+      expect(subject[0]["@metadata"]).to include("index"=>"logstash-2015.11.19")
+      expect(subject[1]["@metadata"]).to include("index"=>"logstash-2015.11.19")
+      expect(subject[0]["@metadata"]).to include("type"=>"foo")
+      expect(subject[1]["@metadata"]).to include("type"=>"foo")
+    end
+  end
+
+  describe "keeps metadata fields after two consecutive non multline lines" do
+    config <<-CONFIG
+    filter {
+       mutate { add_field => { "[@metadata][index]" => "logstash-2015.11.19" } }
+       multiline {
+          pattern => "^%{NUMBER}"
+          what => "next"
+      }
+       mutate { add_field => { "[@metadata][type]" => "foo" } }
+    }
+    CONFIG
+
+    sample ["line1", "line2"] do
+      expect(subject).to be_a(Array)
+      expect(subject[0]["@metadata"]).to include("index"=>"logstash-2015.11.19")
+      expect(subject[1]["@metadata"]).to include("index"=>"logstash-2015.11.19")
+      expect(subject[0]["@metadata"]).to include("type"=>"foo")
+      expect(subject[1]["@metadata"]).to include("type"=>"foo")
+    end
+  end
+
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-multiline
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2015-06-24 00:00:00.000000000 Z
+date: 2015-12-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core
@@ -19,7 +19,7 @@ dependencies:
         version: 1.4.0
     - - <
       - !ruby/object:Gem::Version
-        version: 2.0.0
+        version: 2.0.0.alpha0
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '>='
@@ -27,7 +27,7 @@ dependencies:
         version: 1.4.0
     - - <
       - !ruby/object:Gem::Version
-        version: 2.0.0
+        version: 2.0.0.alpha0
   prerelease: false
   type: :runtime
 - !ruby/object:Gem::Dependency
@@ -125,9 +125,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project:
-rubygems_version: 2.2.2
+rubygems_version: 2.4.6
 signing_key:
 specification_version: 4
 summary: This filter will collapse multiline messages from a single source into one Logstash event.
 test_files:
 - spec/filters/multiline_spec.rb
+has_rdoc: