logstash-filter-mutate 1.0.2 → 2.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/logstash/filters/mutate.rb +9 -4
- data/logstash-filter-mutate.gemspec +3 -3
- data/spec/filters/mutate_spec.rb +156 -0
- metadata +19 -27
- data/.gitignore +0 -4
- data/Rakefile +0 -7
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: bef0aa2c5c7cb7ad5eb0ef8c611df606f9603eb9
|
4
|
+
data.tar.gz: 023ae7f16509abd314efe929633fce32d73cfd30
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 50a1215e8a2f924be132df3e24011b932766fdedf14b49542da5f2fb7fb0ff3f05965988c69cd702fe87a8b70333abda944fdbeb7d90d620cc60a734d60e26f2
|
7
|
+
data.tar.gz: 7d645fbfd6d8947781b4e4db0a0c38dc1467fc083376feba1ac996ef9fbc4d647b4391db7f3dfb716b68e0bf213050d90ccbcfa166f57aac7d2403d6ca882429
|
@@ -226,16 +226,17 @@ class LogStash::Filters::Mutate < LogStash::Filters::Base
|
|
226
226
|
|
227
227
|
private
|
228
228
|
def remove(event)
|
229
|
-
# TODO(sissel): use event.sprintf on the field names?
|
230
229
|
@remove.each do |field|
|
230
|
+
field = event.sprintf(field)
|
231
231
|
event.remove(field)
|
232
232
|
end
|
233
233
|
end # def remove
|
234
234
|
|
235
235
|
private
|
236
236
|
def rename(event)
|
237
|
-
# TODO(sissel): use event.sprintf on the field names?
|
238
237
|
@rename.each do |old, new|
|
238
|
+
old = event.sprintf(old)
|
239
|
+
new = event.sprintf(new)
|
239
240
|
next unless event.include?(old)
|
240
241
|
event[new] = event.remove(old)
|
241
242
|
end
|
@@ -349,7 +350,9 @@ class LogStash::Filters::Mutate < LogStash::Filters::Base
|
|
349
350
|
when Array
|
350
351
|
# can't map upcase! as it replaces an already upcase value with nil
|
351
352
|
# ["ABCDEF"].map(&:upcase!) => [nil]
|
352
|
-
original.map
|
353
|
+
original.map do |elem|
|
354
|
+
(elem.is_a?(String) ? elem.upcase : elem)
|
355
|
+
end
|
353
356
|
when String
|
354
357
|
# nil means no change was made to the String
|
355
358
|
original.upcase! || original
|
@@ -368,7 +371,9 @@ class LogStash::Filters::Mutate < LogStash::Filters::Base
|
|
368
371
|
original = event[field]
|
369
372
|
event[field] = case original
|
370
373
|
when Array
|
371
|
-
original.map
|
374
|
+
original.map! do |elem|
|
375
|
+
(elem.is_a?(String) ? elem.downcase : elem)
|
376
|
+
end
|
372
377
|
when String
|
373
378
|
original.downcase! || original
|
374
379
|
else
|
@@ -1,7 +1,7 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-mutate'
|
4
|
-
s.version = '
|
4
|
+
s.version = '2.0.0'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "The mutate filter allows you to perform general mutations on fields. You can rename, remove, replace, and modify fields in your events."
|
7
7
|
s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
|
@@ -11,7 +11,7 @@ Gem::Specification.new do |s|
|
|
11
11
|
s.require_paths = ["lib"]
|
12
12
|
|
13
13
|
# Files
|
14
|
-
s.files =
|
14
|
+
s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
|
15
15
|
|
16
16
|
# Tests
|
17
17
|
s.test_files = s.files.grep(%r{^(test|spec|features)/})
|
@@ -20,7 +20,7 @@ Gem::Specification.new do |s|
|
|
20
20
|
s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
|
21
21
|
|
22
22
|
# Gem dependencies
|
23
|
-
s.add_runtime_dependency "logstash-core",
|
23
|
+
s.add_runtime_dependency "logstash-core", "~> 2.0.0.snapshot"
|
24
24
|
s.add_runtime_dependency 'logstash-patterns-core'
|
25
25
|
s.add_runtime_dependency 'logstash-filter-grok'
|
26
26
|
s.add_development_dependency 'logstash-devutils'
|
data/spec/filters/mutate_spec.rb
CHANGED
@@ -10,6 +10,100 @@ unless LogStash::Environment.const_defined?(:LOGSTASH_HOME)
|
|
10
10
|
LogStash::Environment::LOGSTASH_HOME = File.expand_path("../../../", __FILE__)
|
11
11
|
end
|
12
12
|
|
13
|
+
|
14
|
+
describe LogStash::Filters::Mutate do
|
15
|
+
|
16
|
+
let(:config) { {} }
|
17
|
+
subject { LogStash::Filters::Mutate.new(config) }
|
18
|
+
|
19
|
+
let(:attrs) { { } }
|
20
|
+
let(:event) { LogStash::Event.new(attrs) }
|
21
|
+
|
22
|
+
before(:each) do
|
23
|
+
subject.register
|
24
|
+
end
|
25
|
+
|
26
|
+
context "when doing uppercase of an array" do
|
27
|
+
|
28
|
+
let(:config) do
|
29
|
+
{ "uppercase" => ["array_of"] }
|
30
|
+
end
|
31
|
+
|
32
|
+
let(:attrs) { { "array_of" => ["a", 2, "C"] } }
|
33
|
+
|
34
|
+
it "should uppercase not raise an error" do
|
35
|
+
expect { subject.filter(event) }.not_to raise_error
|
36
|
+
end
|
37
|
+
|
38
|
+
it "should convert only string elements" do
|
39
|
+
subject.filter(event)
|
40
|
+
expect(event["array_of"]).to eq(["A", 2, "C"])
|
41
|
+
end
|
42
|
+
end
|
43
|
+
|
44
|
+
context "when doing lowercase of an array" do
|
45
|
+
|
46
|
+
let(:config) do
|
47
|
+
{ "lowercase" => ["array_of"] }
|
48
|
+
end
|
49
|
+
|
50
|
+
let(:attrs) { { "array_of" => ["a", 2, "C"] } }
|
51
|
+
|
52
|
+
it "should lowercase all string elements" do
|
53
|
+
expect { subject.filter(event) }.not_to raise_error
|
54
|
+
end
|
55
|
+
|
56
|
+
it "should convert only string elements" do
|
57
|
+
subject.filter(event)
|
58
|
+
expect(event["array_of"]).to eq(["a", 2, "c"])
|
59
|
+
end
|
60
|
+
end
|
61
|
+
|
62
|
+
end
|
63
|
+
|
64
|
+
describe LogStash::Filters::Mutate do
|
65
|
+
|
66
|
+
let(:config) { {} }
|
67
|
+
subject { LogStash::Filters::Mutate.new(config) }
|
68
|
+
|
69
|
+
let(:attrs) { { } }
|
70
|
+
let(:event) { LogStash::Event.new(attrs) }
|
71
|
+
|
72
|
+
before(:each) do
|
73
|
+
subject.register
|
74
|
+
end
|
75
|
+
|
76
|
+
describe "#strip" do
|
77
|
+
|
78
|
+
let(:config) do
|
79
|
+
{ "strip" => ["path"] }
|
80
|
+
end
|
81
|
+
|
82
|
+
let(:attrs) { { "path" => " /store.php " } }
|
83
|
+
|
84
|
+
it "should cleam trailing spaces" do
|
85
|
+
subject.filter(event)
|
86
|
+
expect(event["path"]).to eq("/store.php")
|
87
|
+
end
|
88
|
+
|
89
|
+
context "when converting multiple attributed at once" do
|
90
|
+
|
91
|
+
let(:config) do
|
92
|
+
{ "strip" => ["foo", "bar"] }
|
93
|
+
end
|
94
|
+
|
95
|
+
let(:attrs) { { "foo" => " /bar.php ", "bar" => " foo" } }
|
96
|
+
|
97
|
+
it "should cleam trailing spaces" do
|
98
|
+
subject.filter(event)
|
99
|
+
expect(event["foo"]).to eq("/bar.php")
|
100
|
+
expect(event["bar"]).to eq("foo")
|
101
|
+
end
|
102
|
+
end
|
103
|
+
end
|
104
|
+
|
105
|
+
end
|
106
|
+
|
13
107
|
describe LogStash::Filters::Mutate do
|
14
108
|
|
15
109
|
context "config validation" do
|
@@ -139,6 +233,38 @@ describe LogStash::Filters::Mutate do
|
|
139
233
|
end
|
140
234
|
end
|
141
235
|
|
236
|
+
describe "remove on non-existent field" do
|
237
|
+
config '
|
238
|
+
filter {
|
239
|
+
mutate {
|
240
|
+
remove => "[foo][bar]"
|
241
|
+
}
|
242
|
+
}'
|
243
|
+
|
244
|
+
sample(
|
245
|
+
"abc" => "def"
|
246
|
+
) do
|
247
|
+
insist { subject["abc"] } == "def"
|
248
|
+
end
|
249
|
+
end
|
250
|
+
|
251
|
+
|
252
|
+
describe "remove with dynamic fields (%{})" do
|
253
|
+
config '
|
254
|
+
filter {
|
255
|
+
mutate {
|
256
|
+
remove => [ "field_%{x}" ]
|
257
|
+
}
|
258
|
+
}'
|
259
|
+
|
260
|
+
sample(
|
261
|
+
"x" => "one",
|
262
|
+
"field_one" => "value"
|
263
|
+
) do
|
264
|
+
reject { subject }.include?("field_one")
|
265
|
+
end
|
266
|
+
end
|
267
|
+
|
142
268
|
describe "convert one field to string" do
|
143
269
|
config '
|
144
270
|
filter {
|
@@ -289,6 +415,36 @@ describe LogStash::Filters::Mutate do
|
|
289
415
|
end
|
290
416
|
end
|
291
417
|
|
418
|
+
describe "rename with dynamic origin field (%{})" do
|
419
|
+
config <<-CONFIG
|
420
|
+
filter {
|
421
|
+
mutate {
|
422
|
+
rename => [ "field_%{x}", "destination" ]
|
423
|
+
}
|
424
|
+
}
|
425
|
+
CONFIG
|
426
|
+
|
427
|
+
sample("field_one" => "value", "x" => "one") do
|
428
|
+
reject { subject }.include?("field_one")
|
429
|
+
insist { subject }.include?("destination")
|
430
|
+
end
|
431
|
+
end
|
432
|
+
|
433
|
+
describe "rename with dynamic destination field (%{})" do
|
434
|
+
config <<-CONFIG
|
435
|
+
filter {
|
436
|
+
mutate {
|
437
|
+
rename => [ "origin", "field_%{x}" ]
|
438
|
+
}
|
439
|
+
}
|
440
|
+
CONFIG
|
441
|
+
|
442
|
+
sample("field_one" => "value", "x" => "one") do
|
443
|
+
reject { subject }.include?("origin")
|
444
|
+
insist { subject }.include?("field_one")
|
445
|
+
end
|
446
|
+
end
|
447
|
+
|
292
448
|
describe "convert should work on nested fields" do
|
293
449
|
config <<-CONFIG
|
294
450
|
filter {
|
metadata
CHANGED
@@ -1,91 +1,83 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-mutate
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 2.0.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2015-
|
11
|
+
date: 2015-09-23 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
|
-
name: logstash-core
|
15
|
-
version_requirements: !ruby/object:Gem::Requirement
|
16
|
-
requirements:
|
17
|
-
- - '>='
|
18
|
-
- !ruby/object:Gem::Version
|
19
|
-
version: 1.4.0
|
20
|
-
- - <
|
21
|
-
- !ruby/object:Gem::Version
|
22
|
-
version: 2.0.0
|
23
14
|
requirement: !ruby/object:Gem::Requirement
|
24
15
|
requirements:
|
25
|
-
- -
|
16
|
+
- - ~>
|
26
17
|
- !ruby/object:Gem::Version
|
27
|
-
version:
|
28
|
-
|
29
|
-
- !ruby/object:Gem::Version
|
30
|
-
version: 2.0.0
|
18
|
+
version: 2.0.0.snapshot
|
19
|
+
name: logstash-core
|
31
20
|
prerelease: false
|
32
21
|
type: :runtime
|
33
|
-
- !ruby/object:Gem::Dependency
|
34
|
-
name: logstash-patterns-core
|
35
22
|
version_requirements: !ruby/object:Gem::Requirement
|
36
23
|
requirements:
|
37
|
-
- -
|
24
|
+
- - ~>
|
38
25
|
- !ruby/object:Gem::Version
|
39
|
-
version:
|
26
|
+
version: 2.0.0.snapshot
|
27
|
+
- !ruby/object:Gem::Dependency
|
40
28
|
requirement: !ruby/object:Gem::Requirement
|
41
29
|
requirements:
|
42
30
|
- - '>='
|
43
31
|
- !ruby/object:Gem::Version
|
44
32
|
version: '0'
|
33
|
+
name: logstash-patterns-core
|
45
34
|
prerelease: false
|
46
35
|
type: :runtime
|
47
|
-
- !ruby/object:Gem::Dependency
|
48
|
-
name: logstash-filter-grok
|
49
36
|
version_requirements: !ruby/object:Gem::Requirement
|
50
37
|
requirements:
|
51
38
|
- - '>='
|
52
39
|
- !ruby/object:Gem::Version
|
53
40
|
version: '0'
|
41
|
+
- !ruby/object:Gem::Dependency
|
54
42
|
requirement: !ruby/object:Gem::Requirement
|
55
43
|
requirements:
|
56
44
|
- - '>='
|
57
45
|
- !ruby/object:Gem::Version
|
58
46
|
version: '0'
|
47
|
+
name: logstash-filter-grok
|
59
48
|
prerelease: false
|
60
49
|
type: :runtime
|
61
|
-
- !ruby/object:Gem::Dependency
|
62
|
-
name: logstash-devutils
|
63
50
|
version_requirements: !ruby/object:Gem::Requirement
|
64
51
|
requirements:
|
65
52
|
- - '>='
|
66
53
|
- !ruby/object:Gem::Version
|
67
54
|
version: '0'
|
55
|
+
- !ruby/object:Gem::Dependency
|
68
56
|
requirement: !ruby/object:Gem::Requirement
|
69
57
|
requirements:
|
70
58
|
- - '>='
|
71
59
|
- !ruby/object:Gem::Version
|
72
60
|
version: '0'
|
61
|
+
name: logstash-devutils
|
73
62
|
prerelease: false
|
74
63
|
type: :development
|
64
|
+
version_requirements: !ruby/object:Gem::Requirement
|
65
|
+
requirements:
|
66
|
+
- - '>='
|
67
|
+
- !ruby/object:Gem::Version
|
68
|
+
version: '0'
|
75
69
|
description: This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program
|
76
70
|
email: info@elastic.co
|
77
71
|
executables: []
|
78
72
|
extensions: []
|
79
73
|
extra_rdoc_files: []
|
80
74
|
files:
|
81
|
-
- .gitignore
|
82
75
|
- CHANGELOG.md
|
83
76
|
- CONTRIBUTORS
|
84
77
|
- Gemfile
|
85
78
|
- LICENSE
|
86
79
|
- NOTICE.TXT
|
87
80
|
- README.md
|
88
|
-
- Rakefile
|
89
81
|
- lib/logstash/filters/mutate.rb
|
90
82
|
- logstash-filter-mutate.gemspec
|
91
83
|
- spec/filters/integration/multi_stage_spec.rb
|
@@ -112,7 +104,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
112
104
|
version: '0'
|
113
105
|
requirements: []
|
114
106
|
rubyforge_project:
|
115
|
-
rubygems_version: 2.
|
107
|
+
rubygems_version: 2.4.8
|
116
108
|
signing_key:
|
117
109
|
specification_version: 4
|
118
110
|
summary: The mutate filter allows you to perform general mutations on fields. You can rename, remove, replace, and modify fields in your events.
|
data/.gitignore
DELETED