logstash-filter-multiline 2.0.5 → 3.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +2 -0
- data/Gemfile +3 -1
- data/LICENSE +1 -1
- data/README.md +12 -3
- data/lib/logstash/filters/multiline.rb +5 -7
- data/logstash-filter-multiline.gemspec +4 -4
- data/spec/filters/multiline_spec.rb +28 -28
- metadata +32 -29
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: ed2f76cf601f2f8f263288c27f38e52f2b5ec28f
|
4
|
+
data.tar.gz: 5d4a58a07ad04120b05d337215edc6210cdf3308
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 38995d4ec870df55106bc52230e16eeb3d08f213e6961e7fed0c7cac0a449560e061e8a7b8bb6284ea04b7cb1e9c18b3178a5a555d5961adf310ac17cd974dd9
|
7
|
+
data.tar.gz: e681f7c127697c711032a208f835a0262ec325990943faa3650b9d5501b2e0fc21ba6ca619ee34b297732ba893e6331951efb03658232ca50495d3f031ea21a2
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,5 @@
|
|
1
|
+
## 3.0.0
|
2
|
+
- Update the plugin to the version 2.0 of the plugin api, this change is required for Logstash 5.0 compatibility. See https://github.com/elastic/logstash/issues/5141
|
1
3
|
# 2.0.5
|
2
4
|
- Depend on logstash-core-plugin-api instead of logstash-core, removing the need to mass update plugins on major releases of logstash
|
3
5
|
# 2.0.4
|
data/Gemfile
CHANGED
data/LICENSE
CHANGED
data/README.md
CHANGED
@@ -1,7 +1,6 @@
|
|
1
1
|
# Logstash Plugin
|
2
2
|
|
3
|
-
[![Build
|
4
|
-
Status](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Filters/job/logstash-plugin-filter-multiline-unit/badge/icon)](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Filters/job/logstash-plugin-filter-multiline-unit/)
|
3
|
+
[![Travis Build Status](https://travis-ci.org/logstash-plugins/logstash-filter-multiline.svg)](https://travis-ci.org/logstash-plugins/logstash-filter-multiline)
|
5
4
|
|
6
5
|
This is a plugin for [Logstash](https://github.com/elastic/logstash).
|
7
6
|
|
@@ -56,7 +55,12 @@ gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
|
|
56
55
|
```
|
57
56
|
- Install plugin
|
58
57
|
```sh
|
58
|
+
# Logstash 2.3 and higher
|
59
|
+
bin/logstash-plugin install --no-verify
|
60
|
+
|
61
|
+
# Prior to Logstash 2.3
|
59
62
|
bin/plugin install --no-verify
|
63
|
+
|
60
64
|
```
|
61
65
|
- Run Logstash with your plugin
|
62
66
|
```sh
|
@@ -74,7 +78,12 @@ gem build logstash-filter-awesome.gemspec
|
|
74
78
|
```
|
75
79
|
- Install the plugin from the Logstash home
|
76
80
|
```sh
|
77
|
-
|
81
|
+
# Logstash 2.3 and higher
|
82
|
+
bin/logstash-plugin install --no-verify
|
83
|
+
|
84
|
+
# Prior to Logstash 2.3
|
85
|
+
bin/plugin install --no-verify
|
86
|
+
|
78
87
|
```
|
79
88
|
- Start Logstash and proceed to test the plugin
|
80
89
|
|
@@ -165,12 +165,10 @@ class LogStash::Filters::Multiline < LogStash::Filters::Base
|
|
165
165
|
|
166
166
|
public
|
167
167
|
def filter(event)
|
168
|
-
|
169
|
-
|
170
|
-
match = event[@source].is_a?(Array) ? @grok.match(event[@source].first) : @grok.match(event[@source])
|
168
|
+
match = event.get(@source).is_a?(Array) ? @grok.match(event.get(@source).first) : @grok.match(event.get(@source))
|
171
169
|
match = (match && !@negate) || (!match && @negate) # add negate option
|
172
170
|
|
173
|
-
@logger.debug? && @logger.debug("Multiline", :pattern => @pattern, :message => event
|
171
|
+
@logger.debug? && @logger.debug("Multiline", :pattern => @pattern, :message => event.get(@source), :match => match, :negate => @negate)
|
174
172
|
|
175
173
|
multiline_filter!(event, match)
|
176
174
|
|
@@ -192,7 +190,7 @@ class LogStash::Filters::Multiline < LogStash::Filters::Base
|
|
192
190
|
# if :final flush then select all events
|
193
191
|
expired = @pending.inject({}) do |result, (key, events)|
|
194
192
|
unless events.empty?
|
195
|
-
age = Time.now - events.first
|
193
|
+
age = Time.now - events.first.get("@timestamp").time
|
196
194
|
result[key] = events if (age >= @max_age) || options[:final]
|
197
195
|
end
|
198
196
|
result
|
@@ -231,7 +229,7 @@ class LogStash::Filters::Multiline < LogStash::Filters::Base
|
|
231
229
|
tmp = event.to_hash_with_metadata
|
232
230
|
merged_events = merge(pending)
|
233
231
|
event.overwrite(merged_events)
|
234
|
-
event
|
232
|
+
event.set("@metadata", merged_events.get("@metadata")) # Override does not copy the metadata
|
235
233
|
pending.clear # avoid array creation
|
236
234
|
pending << LogStash::Event.new(tmp)
|
237
235
|
else
|
@@ -257,7 +255,7 @@ class LogStash::Filters::Multiline < LogStash::Filters::Base
|
|
257
255
|
unless pending.empty?
|
258
256
|
merged_events = merge(pending << event)
|
259
257
|
event.overwrite(merged_events)
|
260
|
-
event
|
258
|
+
event.set("@metadata", merged_events.get("@metadata")) # Override does not copy the metadata
|
261
259
|
pending.clear
|
262
260
|
end
|
263
261
|
end # if match
|
@@ -1,10 +1,10 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-multiline'
|
4
|
-
s.version = '
|
4
|
+
s.version = '3.0.0'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "This filter will collapse multiline messages from a single source into one Logstash event."
|
7
|
-
s.description = "This gem is a
|
7
|
+
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
8
8
|
s.authors = ["Elastic"]
|
9
9
|
s.email = 'info@elastic.co'
|
10
10
|
s.homepage = "http://www.elastic.co/guide/en/logstash/current/index.html"
|
@@ -20,11 +20,11 @@ Gem::Specification.new do |s|
|
|
20
20
|
s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
|
21
21
|
|
22
22
|
# Gem dependencies
|
23
|
-
s.add_runtime_dependency "logstash-core-plugin-api", "~>
|
23
|
+
s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
|
24
24
|
s.add_runtime_dependency 'logstash-patterns-core'
|
25
|
-
s.add_development_dependency 'logstash-filter-mutate'
|
26
25
|
s.add_runtime_dependency 'jls-grok', '~> 0.11.0'
|
27
26
|
|
27
|
+
s.add_development_dependency 'logstash-filter-mutate'
|
28
28
|
s.add_development_dependency 'logstash-devutils'
|
29
29
|
end
|
30
30
|
|
@@ -19,8 +19,8 @@ describe LogStash::Filters::Multiline do
|
|
19
19
|
sample [ "hello world", " second line", "another first line" ] do
|
20
20
|
expect(subject).to be_a(Array)
|
21
21
|
insist { subject.size } == 2
|
22
|
-
insist { subject[0]
|
23
|
-
insist { subject[1]
|
22
|
+
insist { subject[0].get("message") } == "hello world\n second line"
|
23
|
+
insist { subject[1].get("message") } == "another first line"
|
24
24
|
end
|
25
25
|
end
|
26
26
|
|
@@ -36,7 +36,7 @@ describe LogStash::Filters::Multiline do
|
|
36
36
|
CONFIG
|
37
37
|
|
38
38
|
sample [ "120913 12:04:33 first line", "second line", "third line" ] do
|
39
|
-
insist { subject
|
39
|
+
insist { subject.get("message") } == "120913 12:04:33 first line\nsecond line\nthird line"
|
40
40
|
end
|
41
41
|
end
|
42
42
|
|
@@ -79,10 +79,10 @@ describe LogStash::Filters::Multiline do
|
|
79
79
|
insist { subject.size } == count
|
80
80
|
|
81
81
|
subject.each_with_index do |event, i|
|
82
|
-
insist { event
|
83
|
-
stream = event
|
84
|
-
insist { event
|
85
|
-
insist { event
|
82
|
+
insist { event.get("type") == event.get("host") } == true
|
83
|
+
stream = event.get("type")
|
84
|
+
insist { event.get("message").split("\n").first } =~ /hello world /
|
85
|
+
insist { event.get("message").scan(/stream\d/).all?{|word| word == stream} } == true
|
86
86
|
end
|
87
87
|
end
|
88
88
|
end
|
@@ -109,8 +109,8 @@ describe LogStash::Filters::Multiline do
|
|
109
109
|
insist { subject.size } == 2
|
110
110
|
|
111
111
|
subject.each do |s|
|
112
|
-
insist { s
|
113
|
-
insist { s
|
112
|
+
insist { s.get("tags").include?("nope") } == true
|
113
|
+
insist { s.get("tags").include?("dummy") } == false
|
114
114
|
insist { s.include?("dummy2") } == true
|
115
115
|
end
|
116
116
|
end
|
@@ -128,7 +128,7 @@ describe LogStash::Filters::Multiline do
|
|
128
128
|
|
129
129
|
sample [ " match", "nomatch" ] do
|
130
130
|
expect(subject).to be_a(LogStash::Event)
|
131
|
-
insist { subject
|
131
|
+
insist { subject.get("message") } == " match\nnomatch"
|
132
132
|
end
|
133
133
|
end
|
134
134
|
|
@@ -145,8 +145,8 @@ describe LogStash::Filters::Multiline do
|
|
145
145
|
sample [" match1", "nomatch1", " match2", "nomatch2"] do
|
146
146
|
expect(subject).to be_a(Array)
|
147
147
|
insist { subject.size } == 2
|
148
|
-
insist { subject[0]
|
149
|
-
insist { subject[1]
|
148
|
+
insist { subject[0].get("message") } == " match1\nnomatch1"
|
149
|
+
insist { subject[1].get("message") } == " match2\nnomatch2"
|
150
150
|
end
|
151
151
|
end
|
152
152
|
|
@@ -163,8 +163,8 @@ describe LogStash::Filters::Multiline do
|
|
163
163
|
sample [" match1", " match1", "nomatch1", " 1match2", " 2match2", " 1match2", "nomatch2"] do
|
164
164
|
expect(subject).to be_a(Array)
|
165
165
|
insist { subject.size } == 2
|
166
|
-
insist { subject[0]
|
167
|
-
insist { subject[1]
|
166
|
+
insist { subject[0].get("message") } == " match1\n match1\nnomatch1"
|
167
|
+
insist { subject[1].get("message") } == " 1match2\n 2match2\n 1match2\nnomatch2"
|
168
168
|
end
|
169
169
|
end
|
170
170
|
|
@@ -182,8 +182,8 @@ describe LogStash::Filters::Multiline do
|
|
182
182
|
sample [" match1", " match1", "nomatch1", " 1match2", " 2match2", " 1match2", "nomatch2"] do
|
183
183
|
expect(subject).to be_a(Array)
|
184
184
|
insist { subject.size } == 2
|
185
|
-
insist { subject[0]
|
186
|
-
insist { subject[1]
|
185
|
+
insist { subject[0].get("message") } == " match1\nnomatch1"
|
186
|
+
insist { subject[1].get("message") } == " 1match2\n 2match2\nnomatch2"
|
187
187
|
end
|
188
188
|
end
|
189
189
|
|
@@ -209,9 +209,9 @@ describe LogStash::Filters::Multiline do
|
|
209
209
|
] do
|
210
210
|
expect(subject).to be_a(Array)
|
211
211
|
insist { subject.size } == 2
|
212
|
-
insist { subject[0]
|
213
|
-
insist { subject[0]
|
214
|
-
insist { subject[1]
|
212
|
+
insist { subject[0].get("foo") } == " match1\n match1\nnomatch1"
|
213
|
+
insist { subject[0].get("message") } == ["bar", "baz"]
|
214
|
+
insist { subject[1].get("foo") } == " 1match2\n 2match2\n 1match2\nnomatch2"
|
215
215
|
end
|
216
216
|
end
|
217
217
|
|
@@ -241,7 +241,7 @@ describe LogStash::Filters::Multiline do
|
|
241
241
|
sample messages do
|
242
242
|
expect(subject).to be_a(Array)
|
243
243
|
insist { subject.size } == 2
|
244
|
-
insist { subject[0]
|
244
|
+
insist { subject[0].get("message") } == messages[0..-2].join("\n")
|
245
245
|
end
|
246
246
|
end
|
247
247
|
|
@@ -260,10 +260,10 @@ describe LogStash::Filters::Multiline do
|
|
260
260
|
|
261
261
|
sample ["line1", "line2"] do
|
262
262
|
expect(subject).to be_a(Array)
|
263
|
-
expect(subject[0]
|
264
|
-
expect(subject[1]
|
265
|
-
expect(subject[0]
|
266
|
-
expect(subject[1]
|
263
|
+
expect(subject[0].get("@metadata")).to include("index"=>"logstash-2015.11.19")
|
264
|
+
expect(subject[1].get("@metadata")).to include("index"=>"logstash-2015.11.19")
|
265
|
+
expect(subject[0].get("@metadata")).to include("type"=>"foo")
|
266
|
+
expect(subject[1].get("@metadata")).to include("type"=>"foo")
|
267
267
|
end
|
268
268
|
end
|
269
269
|
|
@@ -281,10 +281,10 @@ describe LogStash::Filters::Multiline do
|
|
281
281
|
|
282
282
|
sample ["line1", "line2"] do
|
283
283
|
expect(subject).to be_a(Array)
|
284
|
-
expect(subject[0]
|
285
|
-
expect(subject[1]
|
286
|
-
expect(subject[0]
|
287
|
-
expect(subject[1]
|
284
|
+
expect(subject[0].get("@metadata")).to include("index"=>"logstash-2015.11.19")
|
285
|
+
expect(subject[1].get("@metadata")).to include("index"=>"logstash-2015.11.19")
|
286
|
+
expect(subject[0].get("@metadata")).to include("type"=>"foo")
|
287
|
+
expect(subject[1].get("@metadata")).to include("type"=>"foo")
|
288
288
|
end
|
289
289
|
end
|
290
290
|
|
metadata
CHANGED
@@ -1,86 +1,88 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-multiline
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 3.0.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
|
-
autorequire:
|
8
|
+
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2016-
|
11
|
+
date: 2016-05-06 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
|
+
name: logstash-core-plugin-api
|
14
15
|
requirement: !ruby/object:Gem::Requirement
|
15
16
|
requirements:
|
16
17
|
- - "~>"
|
17
18
|
- !ruby/object:Gem::Version
|
18
|
-
version: '
|
19
|
-
name: logstash-core-plugin-api
|
20
|
-
prerelease: false
|
19
|
+
version: '2.0'
|
21
20
|
type: :runtime
|
21
|
+
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - "~>"
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: '
|
26
|
+
version: '2.0'
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
|
+
name: logstash-patterns-core
|
28
29
|
requirement: !ruby/object:Gem::Requirement
|
29
30
|
requirements:
|
30
31
|
- - ">="
|
31
32
|
- !ruby/object:Gem::Version
|
32
33
|
version: '0'
|
33
|
-
name: logstash-patterns-core
|
34
|
-
prerelease: false
|
35
34
|
type: :runtime
|
35
|
+
prerelease: false
|
36
36
|
version_requirements: !ruby/object:Gem::Requirement
|
37
37
|
requirements:
|
38
38
|
- - ">="
|
39
39
|
- !ruby/object:Gem::Version
|
40
40
|
version: '0'
|
41
41
|
- !ruby/object:Gem::Dependency
|
42
|
+
name: jls-grok
|
42
43
|
requirement: !ruby/object:Gem::Requirement
|
43
44
|
requirements:
|
44
|
-
- - "
|
45
|
+
- - "~>"
|
45
46
|
- !ruby/object:Gem::Version
|
46
|
-
version:
|
47
|
-
|
47
|
+
version: 0.11.0
|
48
|
+
type: :runtime
|
48
49
|
prerelease: false
|
49
|
-
type: :development
|
50
50
|
version_requirements: !ruby/object:Gem::Requirement
|
51
51
|
requirements:
|
52
|
-
- - "
|
52
|
+
- - "~>"
|
53
53
|
- !ruby/object:Gem::Version
|
54
|
-
version:
|
54
|
+
version: 0.11.0
|
55
55
|
- !ruby/object:Gem::Dependency
|
56
|
+
name: logstash-filter-mutate
|
56
57
|
requirement: !ruby/object:Gem::Requirement
|
57
58
|
requirements:
|
58
|
-
- - "
|
59
|
+
- - ">="
|
59
60
|
- !ruby/object:Gem::Version
|
60
|
-
version: 0
|
61
|
-
|
61
|
+
version: '0'
|
62
|
+
type: :development
|
62
63
|
prerelease: false
|
63
|
-
type: :runtime
|
64
64
|
version_requirements: !ruby/object:Gem::Requirement
|
65
65
|
requirements:
|
66
|
-
- - "
|
66
|
+
- - ">="
|
67
67
|
- !ruby/object:Gem::Version
|
68
|
-
version: 0
|
68
|
+
version: '0'
|
69
69
|
- !ruby/object:Gem::Dependency
|
70
|
+
name: logstash-devutils
|
70
71
|
requirement: !ruby/object:Gem::Requirement
|
71
72
|
requirements:
|
72
73
|
- - ">="
|
73
74
|
- !ruby/object:Gem::Version
|
74
75
|
version: '0'
|
75
|
-
name: logstash-devutils
|
76
|
-
prerelease: false
|
77
76
|
type: :development
|
77
|
+
prerelease: false
|
78
78
|
version_requirements: !ruby/object:Gem::Requirement
|
79
79
|
requirements:
|
80
80
|
- - ">="
|
81
81
|
- !ruby/object:Gem::Version
|
82
82
|
version: '0'
|
83
|
-
description: This gem is a
|
83
|
+
description: This gem is a Logstash plugin required to be installed on top of the
|
84
|
+
Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
|
85
|
+
gem is not a stand-alone program
|
84
86
|
email: info@elastic.co
|
85
87
|
executables: []
|
86
88
|
extensions: []
|
@@ -101,7 +103,7 @@ licenses:
|
|
101
103
|
metadata:
|
102
104
|
logstash_plugin: 'true'
|
103
105
|
logstash_group: filter
|
104
|
-
post_install_message:
|
106
|
+
post_install_message:
|
105
107
|
rdoc_options: []
|
106
108
|
require_paths:
|
107
109
|
- lib
|
@@ -116,10 +118,11 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
116
118
|
- !ruby/object:Gem::Version
|
117
119
|
version: '0'
|
118
120
|
requirements: []
|
119
|
-
rubyforge_project:
|
120
|
-
rubygems_version: 2.
|
121
|
-
signing_key:
|
121
|
+
rubyforge_project:
|
122
|
+
rubygems_version: 2.5.1
|
123
|
+
signing_key:
|
122
124
|
specification_version: 4
|
123
|
-
summary: This filter will collapse multiline messages from a single source into one
|
125
|
+
summary: This filter will collapse multiline messages from a single source into one
|
126
|
+
Logstash event.
|
124
127
|
test_files:
|
125
128
|
- spec/filters/multiline_spec.rb
|