logstash-filter-mutate 1.0.2 → 2.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/logstash/filters/mutate.rb +9 -4
- data/logstash-filter-mutate.gemspec +3 -3
- data/spec/filters/mutate_spec.rb +156 -0
- metadata +19 -27
- data/.gitignore +0 -4
- data/Rakefile +0 -7
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: bef0aa2c5c7cb7ad5eb0ef8c611df606f9603eb9
|
4
|
+
data.tar.gz: 023ae7f16509abd314efe929633fce32d73cfd30
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 50a1215e8a2f924be132df3e24011b932766fdedf14b49542da5f2fb7fb0ff3f05965988c69cd702fe87a8b70333abda944fdbeb7d90d620cc60a734d60e26f2
|
7
|
+
data.tar.gz: 7d645fbfd6d8947781b4e4db0a0c38dc1467fc083376feba1ac996ef9fbc4d647b4391db7f3dfb716b68e0bf213050d90ccbcfa166f57aac7d2403d6ca882429
|
@@ -226,16 +226,17 @@ class LogStash::Filters::Mutate < LogStash::Filters::Base
|
|
226
226
|
|
227
227
|
private
|
228
228
|
def remove(event)
|
229
|
-
# TODO(sissel): use event.sprintf on the field names?
|
230
229
|
@remove.each do |field|
|
230
|
+
field = event.sprintf(field)
|
231
231
|
event.remove(field)
|
232
232
|
end
|
233
233
|
end # def remove
|
234
234
|
|
235
235
|
private
|
236
236
|
def rename(event)
|
237
|
-
# TODO(sissel): use event.sprintf on the field names?
|
238
237
|
@rename.each do |old, new|
|
238
|
+
old = event.sprintf(old)
|
239
|
+
new = event.sprintf(new)
|
239
240
|
next unless event.include?(old)
|
240
241
|
event[new] = event.remove(old)
|
241
242
|
end
|
@@ -349,7 +350,9 @@ class LogStash::Filters::Mutate < LogStash::Filters::Base
|
|
349
350
|
when Array
|
350
351
|
# can't map upcase! as it replaces an already upcase value with nil
|
351
352
|
# ["ABCDEF"].map(&:upcase!) => [nil]
|
352
|
-
original.map
|
353
|
+
original.map do |elem|
|
354
|
+
(elem.is_a?(String) ? elem.upcase : elem)
|
355
|
+
end
|
353
356
|
when String
|
354
357
|
# nil means no change was made to the String
|
355
358
|
original.upcase! || original
|
@@ -368,7 +371,9 @@ class LogStash::Filters::Mutate < LogStash::Filters::Base
|
|
368
371
|
original = event[field]
|
369
372
|
event[field] = case original
|
370
373
|
when Array
|
371
|
-
original.map
|
374
|
+
original.map! do |elem|
|
375
|
+
(elem.is_a?(String) ? elem.downcase : elem)
|
376
|
+
end
|
372
377
|
when String
|
373
378
|
original.downcase! || original
|
374
379
|
else
|
@@ -1,7 +1,7 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-mutate'
|
4
|
-
s.version = '
|
4
|
+
s.version = '2.0.0'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "The mutate filter allows you to perform general mutations on fields. You can rename, remove, replace, and modify fields in your events."
|
7
7
|
s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
|
@@ -11,7 +11,7 @@ Gem::Specification.new do |s|
|
|
11
11
|
s.require_paths = ["lib"]
|
12
12
|
|
13
13
|
# Files
|
14
|
-
s.files =
|
14
|
+
s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
|
15
15
|
|
16
16
|
# Tests
|
17
17
|
s.test_files = s.files.grep(%r{^(test|spec|features)/})
|
@@ -20,7 +20,7 @@ Gem::Specification.new do |s|
|
|
20
20
|
s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
|
21
21
|
|
22
22
|
# Gem dependencies
|
23
|
-
s.add_runtime_dependency "logstash-core",
|
23
|
+
s.add_runtime_dependency "logstash-core", "~> 2.0.0.snapshot"
|
24
24
|
s.add_runtime_dependency 'logstash-patterns-core'
|
25
25
|
s.add_runtime_dependency 'logstash-filter-grok'
|
26
26
|
s.add_development_dependency 'logstash-devutils'
|
data/spec/filters/mutate_spec.rb
CHANGED
@@ -10,6 +10,100 @@ unless LogStash::Environment.const_defined?(:LOGSTASH_HOME)
|
|
10
10
|
LogStash::Environment::LOGSTASH_HOME = File.expand_path("../../../", __FILE__)
|
11
11
|
end
|
12
12
|
|
13
|
+
|
14
|
+
describe LogStash::Filters::Mutate do
|
15
|
+
|
16
|
+
let(:config) { {} }
|
17
|
+
subject { LogStash::Filters::Mutate.new(config) }
|
18
|
+
|
19
|
+
let(:attrs) { { } }
|
20
|
+
let(:event) { LogStash::Event.new(attrs) }
|
21
|
+
|
22
|
+
before(:each) do
|
23
|
+
subject.register
|
24
|
+
end
|
25
|
+
|
26
|
+
context "when doing uppercase of an array" do
|
27
|
+
|
28
|
+
let(:config) do
|
29
|
+
{ "uppercase" => ["array_of"] }
|
30
|
+
end
|
31
|
+
|
32
|
+
let(:attrs) { { "array_of" => ["a", 2, "C"] } }
|
33
|
+
|
34
|
+
it "should uppercase not raise an error" do
|
35
|
+
expect { subject.filter(event) }.not_to raise_error
|
36
|
+
end
|
37
|
+
|
38
|
+
it "should convert only string elements" do
|
39
|
+
subject.filter(event)
|
40
|
+
expect(event["array_of"]).to eq(["A", 2, "C"])
|
41
|
+
end
|
42
|
+
end
|
43
|
+
|
44
|
+
context "when doing lowercase of an array" do
|
45
|
+
|
46
|
+
let(:config) do
|
47
|
+
{ "lowercase" => ["array_of"] }
|
48
|
+
end
|
49
|
+
|
50
|
+
let(:attrs) { { "array_of" => ["a", 2, "C"] } }
|
51
|
+
|
52
|
+
it "should lowercase all string elements" do
|
53
|
+
expect { subject.filter(event) }.not_to raise_error
|
54
|
+
end
|
55
|
+
|
56
|
+
it "should convert only string elements" do
|
57
|
+
subject.filter(event)
|
58
|
+
expect(event["array_of"]).to eq(["a", 2, "c"])
|
59
|
+
end
|
60
|
+
end
|
61
|
+
|
62
|
+
end
|
63
|
+
|
64
|
+
describe LogStash::Filters::Mutate do
|
65
|
+
|
66
|
+
let(:config) { {} }
|
67
|
+
subject { LogStash::Filters::Mutate.new(config) }
|
68
|
+
|
69
|
+
let(:attrs) { { } }
|
70
|
+
let(:event) { LogStash::Event.new(attrs) }
|
71
|
+
|
72
|
+
before(:each) do
|
73
|
+
subject.register
|
74
|
+
end
|
75
|
+
|
76
|
+
describe "#strip" do
|
77
|
+
|
78
|
+
let(:config) do
|
79
|
+
{ "strip" => ["path"] }
|
80
|
+
end
|
81
|
+
|
82
|
+
let(:attrs) { { "path" => " /store.php " } }
|
83
|
+
|
84
|
+
it "should cleam trailing spaces" do
|
85
|
+
subject.filter(event)
|
86
|
+
expect(event["path"]).to eq("/store.php")
|
87
|
+
end
|
88
|
+
|
89
|
+
context "when converting multiple attributed at once" do
|
90
|
+
|
91
|
+
let(:config) do
|
92
|
+
{ "strip" => ["foo", "bar"] }
|
93
|
+
end
|
94
|
+
|
95
|
+
let(:attrs) { { "foo" => " /bar.php ", "bar" => " foo" } }
|
96
|
+
|
97
|
+
it "should cleam trailing spaces" do
|
98
|
+
subject.filter(event)
|
99
|
+
expect(event["foo"]).to eq("/bar.php")
|
100
|
+
expect(event["bar"]).to eq("foo")
|
101
|
+
end
|
102
|
+
end
|
103
|
+
end
|
104
|
+
|
105
|
+
end
|
106
|
+
|
13
107
|
describe LogStash::Filters::Mutate do
|
14
108
|
|
15
109
|
context "config validation" do
|
@@ -139,6 +233,38 @@ describe LogStash::Filters::Mutate do
|
|
139
233
|
end
|
140
234
|
end
|
141
235
|
|
236
|
+
describe "remove on non-existent field" do
|
237
|
+
config '
|
238
|
+
filter {
|
239
|
+
mutate {
|
240
|
+
remove => "[foo][bar]"
|
241
|
+
}
|
242
|
+
}'
|
243
|
+
|
244
|
+
sample(
|
245
|
+
"abc" => "def"
|
246
|
+
) do
|
247
|
+
insist { subject["abc"] } == "def"
|
248
|
+
end
|
249
|
+
end
|
250
|
+
|
251
|
+
|
252
|
+
describe "remove with dynamic fields (%{})" do
|
253
|
+
config '
|
254
|
+
filter {
|
255
|
+
mutate {
|
256
|
+
remove => [ "field_%{x}" ]
|
257
|
+
}
|
258
|
+
}'
|
259
|
+
|
260
|
+
sample(
|
261
|
+
"x" => "one",
|
262
|
+
"field_one" => "value"
|
263
|
+
) do
|
264
|
+
reject { subject }.include?("field_one")
|
265
|
+
end
|
266
|
+
end
|
267
|
+
|
142
268
|
describe "convert one field to string" do
|
143
269
|
config '
|
144
270
|
filter {
|
@@ -289,6 +415,36 @@ describe LogStash::Filters::Mutate do
|
|
289
415
|
end
|
290
416
|
end
|
291
417
|
|
418
|
+
describe "rename with dynamic origin field (%{})" do
|
419
|
+
config <<-CONFIG
|
420
|
+
filter {
|
421
|
+
mutate {
|
422
|
+
rename => [ "field_%{x}", "destination" ]
|
423
|
+
}
|
424
|
+
}
|
425
|
+
CONFIG
|
426
|
+
|
427
|
+
sample("field_one" => "value", "x" => "one") do
|
428
|
+
reject { subject }.include?("field_one")
|
429
|
+
insist { subject }.include?("destination")
|
430
|
+
end
|
431
|
+
end
|
432
|
+
|
433
|
+
describe "rename with dynamic destination field (%{})" do
|
434
|
+
config <<-CONFIG
|
435
|
+
filter {
|
436
|
+
mutate {
|
437
|
+
rename => [ "origin", "field_%{x}" ]
|
438
|
+
}
|
439
|
+
}
|
440
|
+
CONFIG
|
441
|
+
|
442
|
+
sample("field_one" => "value", "x" => "one") do
|
443
|
+
reject { subject }.include?("origin")
|
444
|
+
insist { subject }.include?("field_one")
|
445
|
+
end
|
446
|
+
end
|
447
|
+
|
292
448
|
describe "convert should work on nested fields" do
|
293
449
|
config <<-CONFIG
|
294
450
|
filter {
|
metadata
CHANGED
@@ -1,91 +1,83 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-mutate
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 2.0.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2015-
|
11
|
+
date: 2015-09-23 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
|
-
name: logstash-core
|
15
|
-
version_requirements: !ruby/object:Gem::Requirement
|
16
|
-
requirements:
|
17
|
-
- - '>='
|
18
|
-
- !ruby/object:Gem::Version
|
19
|
-
version: 1.4.0
|
20
|
-
- - <
|
21
|
-
- !ruby/object:Gem::Version
|
22
|
-
version: 2.0.0
|
23
14
|
requirement: !ruby/object:Gem::Requirement
|
24
15
|
requirements:
|
25
|
-
- -
|
16
|
+
- - ~>
|
26
17
|
- !ruby/object:Gem::Version
|
27
|
-
version:
|
28
|
-
|
29
|
-
- !ruby/object:Gem::Version
|
30
|
-
version: 2.0.0
|
18
|
+
version: 2.0.0.snapshot
|
19
|
+
name: logstash-core
|
31
20
|
prerelease: false
|
32
21
|
type: :runtime
|
33
|
-
- !ruby/object:Gem::Dependency
|
34
|
-
name: logstash-patterns-core
|
35
22
|
version_requirements: !ruby/object:Gem::Requirement
|
36
23
|
requirements:
|
37
|
-
- -
|
24
|
+
- - ~>
|
38
25
|
- !ruby/object:Gem::Version
|
39
|
-
version:
|
26
|
+
version: 2.0.0.snapshot
|
27
|
+
- !ruby/object:Gem::Dependency
|
40
28
|
requirement: !ruby/object:Gem::Requirement
|
41
29
|
requirements:
|
42
30
|
- - '>='
|
43
31
|
- !ruby/object:Gem::Version
|
44
32
|
version: '0'
|
33
|
+
name: logstash-patterns-core
|
45
34
|
prerelease: false
|
46
35
|
type: :runtime
|
47
|
-
- !ruby/object:Gem::Dependency
|
48
|
-
name: logstash-filter-grok
|
49
36
|
version_requirements: !ruby/object:Gem::Requirement
|
50
37
|
requirements:
|
51
38
|
- - '>='
|
52
39
|
- !ruby/object:Gem::Version
|
53
40
|
version: '0'
|
41
|
+
- !ruby/object:Gem::Dependency
|
54
42
|
requirement: !ruby/object:Gem::Requirement
|
55
43
|
requirements:
|
56
44
|
- - '>='
|
57
45
|
- !ruby/object:Gem::Version
|
58
46
|
version: '0'
|
47
|
+
name: logstash-filter-grok
|
59
48
|
prerelease: false
|
60
49
|
type: :runtime
|
61
|
-
- !ruby/object:Gem::Dependency
|
62
|
-
name: logstash-devutils
|
63
50
|
version_requirements: !ruby/object:Gem::Requirement
|
64
51
|
requirements:
|
65
52
|
- - '>='
|
66
53
|
- !ruby/object:Gem::Version
|
67
54
|
version: '0'
|
55
|
+
- !ruby/object:Gem::Dependency
|
68
56
|
requirement: !ruby/object:Gem::Requirement
|
69
57
|
requirements:
|
70
58
|
- - '>='
|
71
59
|
- !ruby/object:Gem::Version
|
72
60
|
version: '0'
|
61
|
+
name: logstash-devutils
|
73
62
|
prerelease: false
|
74
63
|
type: :development
|
64
|
+
version_requirements: !ruby/object:Gem::Requirement
|
65
|
+
requirements:
|
66
|
+
- - '>='
|
67
|
+
- !ruby/object:Gem::Version
|
68
|
+
version: '0'
|
75
69
|
description: This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program
|
76
70
|
email: info@elastic.co
|
77
71
|
executables: []
|
78
72
|
extensions: []
|
79
73
|
extra_rdoc_files: []
|
80
74
|
files:
|
81
|
-
- .gitignore
|
82
75
|
- CHANGELOG.md
|
83
76
|
- CONTRIBUTORS
|
84
77
|
- Gemfile
|
85
78
|
- LICENSE
|
86
79
|
- NOTICE.TXT
|
87
80
|
- README.md
|
88
|
-
- Rakefile
|
89
81
|
- lib/logstash/filters/mutate.rb
|
90
82
|
- logstash-filter-mutate.gemspec
|
91
83
|
- spec/filters/integration/multi_stage_spec.rb
|
@@ -112,7 +104,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
112
104
|
version: '0'
|
113
105
|
requirements: []
|
114
106
|
rubyforge_project:
|
115
|
-
rubygems_version: 2.
|
107
|
+
rubygems_version: 2.4.8
|
116
108
|
signing_key:
|
117
109
|
specification_version: 4
|
118
110
|
summary: The mutate filter allows you to perform general mutations on fields. You can rename, remove, replace, and modify fields in your events.
|
data/.gitignore
DELETED