logstash-filter-mutate 1.0.0 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +3 -0
- data/Gemfile +1 -1
- data/lib/logstash/filters/mutate.rb +25 -18
- data/logstash-filter-mutate.gemspec +1 -1
- data/spec/filters/integration/multi_stage_spec.rb +66 -0
- data/spec/filters/mutate_spec.rb +50 -49
- metadata +5 -3
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: c6e8dbce3ff65a25dce65dbd8ae7751a404cd60a
|
4
|
+
data.tar.gz: 9d2cfdaf0d3af46964281aa880c2f70dbf6768dd
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 2fe9cdfb16596fe8dc140a6b31f44a442de3ce76c30d5090f627bb3187c2c1f55b58da9af6b825710ec2470014417226e272c891fe08f595b354b080a00bcb17
|
7
|
+
data.tar.gz: c1fed55596c84f174835abf6a5d7a44e7281c5d8d31aa523a017e9c3d5d348f0570c6e43930c6a76ab67a6dd1cb6cb83ea1fb061d2e1028d73343178f6945595
|
data/CHANGELOG.md
CHANGED
data/Gemfile
CHANGED
@@ -1,2 +1,2 @@
|
|
1
1
|
source 'https://rubygems.org'
|
2
|
-
gemspec
|
2
|
+
gemspec
|
@@ -62,11 +62,11 @@ class LogStash::Filters::Mutate < LogStash::Filters::Base
|
|
62
62
|
# If the field is a hash, no action will be taken.
|
63
63
|
#
|
64
64
|
# If the conversion type is `boolean`, the acceptable values are:
|
65
|
-
#
|
65
|
+
#
|
66
66
|
# * **True:** `true`, `t`, `yes`, `y`, and `1`
|
67
67
|
# * **False:** `false`, `f`, `no`, `n`, and `0`
|
68
68
|
#
|
69
|
-
# If a value other than these is provided, it will pass straight through
|
69
|
+
# If a value other than these is provided, it will pass straight through
|
70
70
|
# and log a warning message.
|
71
71
|
#
|
72
72
|
# Valid conversion targets are: integer, float, string, and boolean.
|
@@ -341,31 +341,38 @@ class LogStash::Filters::Mutate < LogStash::Filters::Base
|
|
341
341
|
private
|
342
342
|
def uppercase(event)
|
343
343
|
@uppercase.each do |field|
|
344
|
-
|
345
|
-
|
346
|
-
|
347
|
-
|
348
|
-
|
349
|
-
|
350
|
-
|
351
|
-
|
344
|
+
original = event[field]
|
345
|
+
event[field] = case original
|
346
|
+
when Array
|
347
|
+
original.map(&:upcase!)
|
348
|
+
when String
|
349
|
+
original.upcase!
|
350
|
+
else
|
351
|
+
@logger.debug("Can't uppercase something that isn't a string",
|
352
|
+
:field => field, :value => original)
|
353
|
+
original
|
354
|
+
end
|
352
355
|
end
|
353
356
|
end # def uppercase
|
354
357
|
|
355
358
|
private
|
356
359
|
def lowercase(event)
|
357
360
|
@lowercase.each do |field|
|
358
|
-
|
359
|
-
|
360
|
-
|
361
|
-
|
362
|
-
|
363
|
-
|
364
|
-
|
365
|
-
|
361
|
+
original = event[field]
|
362
|
+
event[field] = case original
|
363
|
+
when Array
|
364
|
+
original.map(&:downcase!)
|
365
|
+
when String
|
366
|
+
original.downcase!
|
367
|
+
else
|
368
|
+
@logger.debug("Can't lowercase something that isn't a string",
|
369
|
+
:field => field, :value => original)
|
370
|
+
original
|
371
|
+
end
|
366
372
|
end
|
367
373
|
end # def lowercase
|
368
374
|
|
375
|
+
|
369
376
|
private
|
370
377
|
def split(event)
|
371
378
|
@split.each do |field, separator|
|
@@ -1,7 +1,7 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-mutate'
|
4
|
-
s.version = '1.0.
|
4
|
+
s.version = '1.0.1'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "The mutate filter allows you to perform general mutations on fields. You can rename, remove, replace, and modify fields in your events."
|
7
7
|
s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
|
@@ -0,0 +1,66 @@
|
|
1
|
+
# encoding: utf-8
|
2
|
+
require "logstash/devutils/rspec/spec_helper"
|
3
|
+
require "logstash/filters/mutate"
|
4
|
+
|
5
|
+
# running mutate which depends on grok outside a logstash package means
|
6
|
+
# LOGSTASH_HOME will not be defined, so let's set it here
|
7
|
+
# before requiring the grok filter
|
8
|
+
unless LogStash::Environment.const_defined?(:LOGSTASH_HOME)
|
9
|
+
LogStash::Environment::LOGSTASH_HOME = File.expand_path("../../../", __FILE__)
|
10
|
+
end
|
11
|
+
|
12
|
+
describe LogStash::Filters::Mutate do
|
13
|
+
let(:pipeline) { LogStash::Pipeline.new(config) }
|
14
|
+
let(:events) do
|
15
|
+
arr = event.is_a?(Array) ? event : [event]
|
16
|
+
arr.map do |evt|
|
17
|
+
LogStash::Event.new(evt.is_a?(String) ? LogStash::Json.load(evt) : evt)
|
18
|
+
end
|
19
|
+
end
|
20
|
+
|
21
|
+
let(:results) do
|
22
|
+
pipeline.instance_eval { @filters.each(&:register) }
|
23
|
+
results = []
|
24
|
+
events.each do |evt|
|
25
|
+
# filter call the block on all filtered events, included new events added by the filter
|
26
|
+
pipeline.filter(evt) do |filtered_event|
|
27
|
+
results.push(filtered_event)
|
28
|
+
end
|
29
|
+
end
|
30
|
+
pipeline.flush_filters(:final => true) { |flushed_event| results << flushed_event }
|
31
|
+
|
32
|
+
results.select { |e| !e.cancelled? }
|
33
|
+
end
|
34
|
+
|
35
|
+
describe 'MUTATE-33: multi stage with json, grok and mutate, Case mutation' do
|
36
|
+
let(:event) do
|
37
|
+
"{\"message\":\"hello WORLD\",\"examplefield\":\"PPQQRRSS\"}"
|
38
|
+
end
|
39
|
+
|
40
|
+
let(:config) do
|
41
|
+
<<-CONFIG
|
42
|
+
filter {
|
43
|
+
grok {
|
44
|
+
match => { "message" => "(?:hello) %{WORD:bar}" }
|
45
|
+
break_on_match => false
|
46
|
+
singles => true
|
47
|
+
}
|
48
|
+
mutate {
|
49
|
+
lowercase => [ "bar", "examplefield" ]
|
50
|
+
}
|
51
|
+
}
|
52
|
+
CONFIG
|
53
|
+
end
|
54
|
+
|
55
|
+
it 'change case of the target, bar value is lowercase' do
|
56
|
+
result = results.first
|
57
|
+
expect(result["bar"]).to eq('world')
|
58
|
+
end
|
59
|
+
|
60
|
+
it 'change case of the target, examplefield value is lowercase' do
|
61
|
+
result = results.first
|
62
|
+
expect(result["examplefield"]).to eq("ppqqrrss")
|
63
|
+
end
|
64
|
+
|
65
|
+
end
|
66
|
+
end
|
data/spec/filters/mutate_spec.rb
CHANGED
@@ -23,7 +23,7 @@ describe LogStash::Filters::Mutate do
|
|
23
23
|
CONFIG
|
24
24
|
|
25
25
|
sample "not_really_important" do
|
26
|
-
|
26
|
+
expect {subject}.to raise_error LogStash::ConfigurationError
|
27
27
|
end
|
28
28
|
end
|
29
29
|
describe "invalid gsub triad should raise a configuration error" do
|
@@ -36,7 +36,7 @@ describe LogStash::Filters::Mutate do
|
|
36
36
|
CONFIG
|
37
37
|
|
38
38
|
sample "not_really_important" do
|
39
|
-
|
39
|
+
expect {subject}.to raise_error LogStash::ConfigurationError
|
40
40
|
end
|
41
41
|
end
|
42
42
|
end
|
@@ -70,18 +70,18 @@ describe LogStash::Filters::Mutate do
|
|
70
70
|
}
|
71
71
|
|
72
72
|
sample event do
|
73
|
-
|
74
|
-
|
75
|
-
|
76
|
-
|
77
|
-
|
78
|
-
|
79
|
-
|
80
|
-
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
|
73
|
+
expect(subject["lowerme"]).to eq ['example']
|
74
|
+
expect(subject["upperme"]).to eq ['EXAMPLE']
|
75
|
+
expect(subject["intme"] ).to eq [1234, 7890, 7]
|
76
|
+
expect(subject["floatme"]).to eq [1234.455]
|
77
|
+
expect(subject).not_to include("rename1")
|
78
|
+
expect(subject["rename2"]).to eq [ "hello world" ]
|
79
|
+
expect(subject).not_to include("removeme")
|
80
|
+
|
81
|
+
expect(subject).to include("newfield")
|
82
|
+
expect(subject["newfield"]).to eq "newnew"
|
83
|
+
expect(subject).not_to include("nosuchfield")
|
84
|
+
expect(subject["updateme"]).to eq "updated"
|
85
85
|
end
|
86
86
|
end
|
87
87
|
|
@@ -100,11 +100,12 @@ describe LogStash::Filters::Mutate do
|
|
100
100
|
"survivor" => "Hello.",
|
101
101
|
"one" => { "two" => "wee" }
|
102
102
|
) do
|
103
|
-
|
104
|
-
|
105
|
-
|
106
|
-
|
107
|
-
|
103
|
+
expect(subject["survivor"]).to eq "Hello."
|
104
|
+
|
105
|
+
expect(subject).not_to include("remove-me")
|
106
|
+
expect(subject).not_to include("remove-me2")
|
107
|
+
expect(subject).not_to include("diedie")
|
108
|
+
expect(subject["one"]).not_to include("two")
|
108
109
|
end
|
109
110
|
end
|
110
111
|
|
@@ -117,7 +118,7 @@ describe LogStash::Filters::Mutate do
|
|
117
118
|
}'
|
118
119
|
|
119
120
|
sample("unicorns" => 1234) do
|
120
|
-
|
121
|
+
expect(subject["unicorns"]).to eq "1234"
|
121
122
|
end
|
122
123
|
end
|
123
124
|
|
@@ -176,7 +177,7 @@ describe LogStash::Filters::Mutate do
|
|
176
177
|
}'
|
177
178
|
|
178
179
|
sample("unicorns" => "Magnificient, but extinct, animals") do
|
179
|
-
|
180
|
+
expect(subject["unicorns"]).to eq "Magnificient, and common, animals"
|
180
181
|
end
|
181
182
|
end
|
182
183
|
|
@@ -191,7 +192,7 @@ describe LogStash::Filters::Mutate do
|
|
191
192
|
sample("unicorns" => [
|
192
193
|
"Magnificient extinct animals", "Other extinct ideas" ]
|
193
194
|
) do
|
194
|
-
|
195
|
+
expect(subject["unicorns"]).to eq [
|
195
196
|
"Magnificient common animals",
|
196
197
|
"Other common ideas"
|
197
198
|
]
|
@@ -208,8 +209,8 @@ describe LogStash::Filters::Mutate do
|
|
208
209
|
}'
|
209
210
|
|
210
211
|
sample("colors" => "One red car", "shapes" => "Four red squares") do
|
211
|
-
|
212
|
-
|
212
|
+
expect(subject["colors"]).to eq "One blue car"
|
213
|
+
expect(subject["shapes"]).to eq "Four red circles"
|
213
214
|
end
|
214
215
|
end
|
215
216
|
|
@@ -222,7 +223,7 @@ describe LogStash::Filters::Mutate do
|
|
222
223
|
}'
|
223
224
|
|
224
225
|
sample("colors" => "red3") do
|
225
|
-
|
226
|
+
expect(subject["colors"]).to eq "redblue"
|
226
227
|
end
|
227
228
|
end
|
228
229
|
|
@@ -239,7 +240,7 @@ describe LogStash::Filters::Mutate do
|
|
239
240
|
CONFIG
|
240
241
|
|
241
242
|
sample "HELLO WORLD" do
|
242
|
-
|
243
|
+
expect(subject["foo"]).to eq "hello"
|
243
244
|
end
|
244
245
|
end
|
245
246
|
|
@@ -253,8 +254,8 @@ describe LogStash::Filters::Mutate do
|
|
253
254
|
CONFIG
|
254
255
|
|
255
256
|
sample "whatever" do
|
256
|
-
|
257
|
-
|
257
|
+
expect(subject).not_to include("nosuchfield")
|
258
|
+
expect(subject).not_to include("hello")
|
258
259
|
end
|
259
260
|
end
|
260
261
|
|
@@ -268,8 +269,8 @@ describe LogStash::Filters::Mutate do
|
|
268
269
|
CONFIG
|
269
270
|
|
270
271
|
sample({ "foo" => { "bar" => "1000" } }) do
|
271
|
-
|
272
|
-
|
272
|
+
expect(subject["[foo][bar]"]).to eq 1000
|
273
|
+
expect(subject["[foo][bar]"]).to be_a(Fixnum)
|
273
274
|
end
|
274
275
|
end
|
275
276
|
|
@@ -283,8 +284,8 @@ describe LogStash::Filters::Mutate do
|
|
283
284
|
CONFIG
|
284
285
|
|
285
286
|
sample({ "foo" => ["100", "200"] }) do
|
286
|
-
|
287
|
-
|
287
|
+
expect(subject["[foo][0]"]).to eq 100
|
288
|
+
expect(subject["[foo][0]"]).to be_a(Fixnum)
|
288
289
|
end
|
289
290
|
end
|
290
291
|
|
@@ -298,7 +299,7 @@ describe LogStash::Filters::Mutate do
|
|
298
299
|
}'
|
299
300
|
|
300
301
|
sample("unicorns" => "Unicorns of type blue are common", "unicorn_type" => "blue") do
|
301
|
-
|
302
|
+
expect(subject["unicorns"]).to eq "Unicorns green are common"
|
302
303
|
end
|
303
304
|
end
|
304
305
|
|
@@ -312,7 +313,7 @@ describe LogStash::Filters::Mutate do
|
|
312
313
|
}'
|
313
314
|
|
314
315
|
sample("unicorns2" => "Unicorns of type blue are common", "unicorn_color" => "blue") do
|
315
|
-
|
316
|
+
expect(subject["unicorns2"]).to eq "Unicorns blue and green are common"
|
316
317
|
end
|
317
318
|
end
|
318
319
|
|
@@ -329,7 +330,7 @@ describe LogStash::Filters::Mutate do
|
|
329
330
|
"Unicorns of type blue are found in Alaska", "Unicorns of type blue are extinct" ],
|
330
331
|
"color" => "blue"
|
331
332
|
) do
|
332
|
-
|
333
|
+
expect(subject["unicorns_array"]).to eq [
|
333
334
|
"Unicorns blue and green are found in Alaska",
|
334
335
|
"Unicorns blue and green are extinct"
|
335
336
|
]
|
@@ -345,8 +346,8 @@ describe LogStash::Filters::Mutate do
|
|
345
346
|
}'
|
346
347
|
|
347
348
|
sample("foo" => "bar") do
|
348
|
-
|
349
|
-
|
349
|
+
expect(subject["list"]).to eq ["bar"]
|
350
|
+
expect(subject["foo"]).to eq "bar"
|
350
351
|
end
|
351
352
|
end
|
352
353
|
|
@@ -359,8 +360,8 @@ describe LogStash::Filters::Mutate do
|
|
359
360
|
}'
|
360
361
|
|
361
362
|
sample("foo" => "bar", "list" => []) do
|
362
|
-
|
363
|
-
|
363
|
+
expect(subject["list"]).to eq ["bar"]
|
364
|
+
expect(subject["foo"]).to eq "bar"
|
364
365
|
end
|
365
366
|
end
|
366
367
|
|
@@ -373,8 +374,8 @@ describe LogStash::Filters::Mutate do
|
|
373
374
|
}'
|
374
375
|
|
375
376
|
sample("foo" => "bar", "list" => ["baz"]) do
|
376
|
-
|
377
|
-
|
377
|
+
expect(subject["list"]).to eq ["baz", "bar"]
|
378
|
+
expect(subject["foo"]).to eq "bar"
|
378
379
|
end
|
379
380
|
end
|
380
381
|
|
@@ -387,8 +388,8 @@ describe LogStash::Filters::Mutate do
|
|
387
388
|
}'
|
388
389
|
|
389
390
|
sample("foo" => ["bar"], "list" => ["baz"]) do
|
390
|
-
|
391
|
-
|
391
|
+
expect(subject["list"]).to eq ["baz", "bar"]
|
392
|
+
expect(subject["foo"]).to eq ["bar"]
|
392
393
|
end
|
393
394
|
end
|
394
395
|
|
@@ -401,8 +402,8 @@ describe LogStash::Filters::Mutate do
|
|
401
402
|
}'
|
402
403
|
|
403
404
|
sample("foo" => [], "list" => ["baz"]) do
|
404
|
-
|
405
|
-
|
405
|
+
expect(subject["list"]).to eq ["baz"]
|
406
|
+
expect(subject["foo"]).to eq []
|
406
407
|
end
|
407
408
|
end
|
408
409
|
|
@@ -415,8 +416,8 @@ describe LogStash::Filters::Mutate do
|
|
415
416
|
}'
|
416
417
|
|
417
418
|
sample("foo" => ["bar"], "list" => "baz") do
|
418
|
-
|
419
|
-
|
419
|
+
expect(subject["list"]).to eq ["baz", "bar"]
|
420
|
+
expect(subject["foo"]).to eq ["bar"]
|
420
421
|
end
|
421
422
|
end
|
422
423
|
|
@@ -429,8 +430,8 @@ describe LogStash::Filters::Mutate do
|
|
429
430
|
}'
|
430
431
|
|
431
432
|
sample("foo" => "bar", "list" => "baz") do
|
432
|
-
|
433
|
-
|
433
|
+
expect(subject["list"]).to eq ["baz", "bar"]
|
434
|
+
expect(subject["foo"]).to eq "bar"
|
434
435
|
end
|
435
436
|
end
|
436
437
|
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-mutate
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.0.
|
4
|
+
version: 1.0.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2015-
|
11
|
+
date: 2015-08-14 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: logstash-core
|
@@ -88,6 +88,7 @@ files:
|
|
88
88
|
- Rakefile
|
89
89
|
- lib/logstash/filters/mutate.rb
|
90
90
|
- logstash-filter-mutate.gemspec
|
91
|
+
- spec/filters/integration/multi_stage_spec.rb
|
91
92
|
- spec/filters/mutate_spec.rb
|
92
93
|
homepage: http://www.elastic.co/guide/en/logstash/current/index.html
|
93
94
|
licenses:
|
@@ -111,9 +112,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
111
112
|
version: '0'
|
112
113
|
requirements: []
|
113
114
|
rubyforge_project:
|
114
|
-
rubygems_version: 2.
|
115
|
+
rubygems_version: 2.1.9
|
115
116
|
signing_key:
|
116
117
|
specification_version: 4
|
117
118
|
summary: The mutate filter allows you to perform general mutations on fields. You can rename, remove, replace, and modify fields in your events.
|
118
119
|
test_files:
|
120
|
+
- spec/filters/integration/multi_stage_spec.rb
|
119
121
|
- spec/filters/mutate_spec.rb
|