logstash-filter-mutate 1.0.0 → 1.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +3 -0
- data/Gemfile +1 -1
- data/lib/logstash/filters/mutate.rb +25 -18
- data/logstash-filter-mutate.gemspec +1 -1
- data/spec/filters/integration/multi_stage_spec.rb +66 -0
- data/spec/filters/mutate_spec.rb +50 -49
- metadata +5 -3
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: c6e8dbce3ff65a25dce65dbd8ae7751a404cd60a
|
4
|
+
data.tar.gz: 9d2cfdaf0d3af46964281aa880c2f70dbf6768dd
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 2fe9cdfb16596fe8dc140a6b31f44a442de3ce76c30d5090f627bb3187c2c1f55b58da9af6b825710ec2470014417226e272c891fe08f595b354b080a00bcb17
|
7
|
+
data.tar.gz: c1fed55596c84f174835abf6a5d7a44e7281c5d8d31aa523a017e9c3d5d348f0570c6e43930c6a76ab67a6dd1cb6cb83ea1fb061d2e1028d73343178f6945595
|
data/CHANGELOG.md
CHANGED
data/Gemfile
CHANGED
@@ -1,2 +1,2 @@
|
|
1
1
|
source 'https://rubygems.org'
|
2
|
-
gemspec
|
2
|
+
gemspec
|
@@ -62,11 +62,11 @@ class LogStash::Filters::Mutate < LogStash::Filters::Base
|
|
62
62
|
# If the field is a hash, no action will be taken.
|
63
63
|
#
|
64
64
|
# If the conversion type is `boolean`, the acceptable values are:
|
65
|
-
#
|
65
|
+
#
|
66
66
|
# * **True:** `true`, `t`, `yes`, `y`, and `1`
|
67
67
|
# * **False:** `false`, `f`, `no`, `n`, and `0`
|
68
68
|
#
|
69
|
-
# If a value other than these is provided, it will pass straight through
|
69
|
+
# If a value other than these is provided, it will pass straight through
|
70
70
|
# and log a warning message.
|
71
71
|
#
|
72
72
|
# Valid conversion targets are: integer, float, string, and boolean.
|
@@ -341,31 +341,38 @@ class LogStash::Filters::Mutate < LogStash::Filters::Base
|
|
341
341
|
private
|
342
342
|
def uppercase(event)
|
343
343
|
@uppercase.each do |field|
|
344
|
-
|
345
|
-
|
346
|
-
|
347
|
-
|
348
|
-
|
349
|
-
|
350
|
-
|
351
|
-
|
344
|
+
original = event[field]
|
345
|
+
event[field] = case original
|
346
|
+
when Array
|
347
|
+
original.map(&:upcase!)
|
348
|
+
when String
|
349
|
+
original.upcase!
|
350
|
+
else
|
351
|
+
@logger.debug("Can't uppercase something that isn't a string",
|
352
|
+
:field => field, :value => original)
|
353
|
+
original
|
354
|
+
end
|
352
355
|
end
|
353
356
|
end # def uppercase
|
354
357
|
|
355
358
|
private
|
356
359
|
def lowercase(event)
|
357
360
|
@lowercase.each do |field|
|
358
|
-
|
359
|
-
|
360
|
-
|
361
|
-
|
362
|
-
|
363
|
-
|
364
|
-
|
365
|
-
|
361
|
+
original = event[field]
|
362
|
+
event[field] = case original
|
363
|
+
when Array
|
364
|
+
original.map(&:downcase!)
|
365
|
+
when String
|
366
|
+
original.downcase!
|
367
|
+
else
|
368
|
+
@logger.debug("Can't lowercase something that isn't a string",
|
369
|
+
:field => field, :value => original)
|
370
|
+
original
|
371
|
+
end
|
366
372
|
end
|
367
373
|
end # def lowercase
|
368
374
|
|
375
|
+
|
369
376
|
private
|
370
377
|
def split(event)
|
371
378
|
@split.each do |field, separator|
|
@@ -1,7 +1,7 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-filter-mutate'
|
4
|
-
s.version = '1.0.
|
4
|
+
s.version = '1.0.1'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "The mutate filter allows you to perform general mutations on fields. You can rename, remove, replace, and modify fields in your events."
|
7
7
|
s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
|
@@ -0,0 +1,66 @@
|
|
1
|
+
# encoding: utf-8
|
2
|
+
require "logstash/devutils/rspec/spec_helper"
|
3
|
+
require "logstash/filters/mutate"
|
4
|
+
|
5
|
+
# running mutate which depends on grok outside a logstash package means
|
6
|
+
# LOGSTASH_HOME will not be defined, so let's set it here
|
7
|
+
# before requiring the grok filter
|
8
|
+
unless LogStash::Environment.const_defined?(:LOGSTASH_HOME)
|
9
|
+
LogStash::Environment::LOGSTASH_HOME = File.expand_path("../../../", __FILE__)
|
10
|
+
end
|
11
|
+
|
12
|
+
describe LogStash::Filters::Mutate do
|
13
|
+
let(:pipeline) { LogStash::Pipeline.new(config) }
|
14
|
+
let(:events) do
|
15
|
+
arr = event.is_a?(Array) ? event : [event]
|
16
|
+
arr.map do |evt|
|
17
|
+
LogStash::Event.new(evt.is_a?(String) ? LogStash::Json.load(evt) : evt)
|
18
|
+
end
|
19
|
+
end
|
20
|
+
|
21
|
+
let(:results) do
|
22
|
+
pipeline.instance_eval { @filters.each(&:register) }
|
23
|
+
results = []
|
24
|
+
events.each do |evt|
|
25
|
+
# filter call the block on all filtered events, included new events added by the filter
|
26
|
+
pipeline.filter(evt) do |filtered_event|
|
27
|
+
results.push(filtered_event)
|
28
|
+
end
|
29
|
+
end
|
30
|
+
pipeline.flush_filters(:final => true) { |flushed_event| results << flushed_event }
|
31
|
+
|
32
|
+
results.select { |e| !e.cancelled? }
|
33
|
+
end
|
34
|
+
|
35
|
+
describe 'MUTATE-33: multi stage with json, grok and mutate, Case mutation' do
|
36
|
+
let(:event) do
|
37
|
+
"{\"message\":\"hello WORLD\",\"examplefield\":\"PPQQRRSS\"}"
|
38
|
+
end
|
39
|
+
|
40
|
+
let(:config) do
|
41
|
+
<<-CONFIG
|
42
|
+
filter {
|
43
|
+
grok {
|
44
|
+
match => { "message" => "(?:hello) %{WORD:bar}" }
|
45
|
+
break_on_match => false
|
46
|
+
singles => true
|
47
|
+
}
|
48
|
+
mutate {
|
49
|
+
lowercase => [ "bar", "examplefield" ]
|
50
|
+
}
|
51
|
+
}
|
52
|
+
CONFIG
|
53
|
+
end
|
54
|
+
|
55
|
+
it 'change case of the target, bar value is lowercase' do
|
56
|
+
result = results.first
|
57
|
+
expect(result["bar"]).to eq('world')
|
58
|
+
end
|
59
|
+
|
60
|
+
it 'change case of the target, examplefield value is lowercase' do
|
61
|
+
result = results.first
|
62
|
+
expect(result["examplefield"]).to eq("ppqqrrss")
|
63
|
+
end
|
64
|
+
|
65
|
+
end
|
66
|
+
end
|
data/spec/filters/mutate_spec.rb
CHANGED
@@ -23,7 +23,7 @@ describe LogStash::Filters::Mutate do
|
|
23
23
|
CONFIG
|
24
24
|
|
25
25
|
sample "not_really_important" do
|
26
|
-
|
26
|
+
expect {subject}.to raise_error LogStash::ConfigurationError
|
27
27
|
end
|
28
28
|
end
|
29
29
|
describe "invalid gsub triad should raise a configuration error" do
|
@@ -36,7 +36,7 @@ describe LogStash::Filters::Mutate do
|
|
36
36
|
CONFIG
|
37
37
|
|
38
38
|
sample "not_really_important" do
|
39
|
-
|
39
|
+
expect {subject}.to raise_error LogStash::ConfigurationError
|
40
40
|
end
|
41
41
|
end
|
42
42
|
end
|
@@ -70,18 +70,18 @@ describe LogStash::Filters::Mutate do
|
|
70
70
|
}
|
71
71
|
|
72
72
|
sample event do
|
73
|
-
|
74
|
-
|
75
|
-
|
76
|
-
|
77
|
-
|
78
|
-
|
79
|
-
|
80
|
-
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
|
73
|
+
expect(subject["lowerme"]).to eq ['example']
|
74
|
+
expect(subject["upperme"]).to eq ['EXAMPLE']
|
75
|
+
expect(subject["intme"] ).to eq [1234, 7890, 7]
|
76
|
+
expect(subject["floatme"]).to eq [1234.455]
|
77
|
+
expect(subject).not_to include("rename1")
|
78
|
+
expect(subject["rename2"]).to eq [ "hello world" ]
|
79
|
+
expect(subject).not_to include("removeme")
|
80
|
+
|
81
|
+
expect(subject).to include("newfield")
|
82
|
+
expect(subject["newfield"]).to eq "newnew"
|
83
|
+
expect(subject).not_to include("nosuchfield")
|
84
|
+
expect(subject["updateme"]).to eq "updated"
|
85
85
|
end
|
86
86
|
end
|
87
87
|
|
@@ -100,11 +100,12 @@ describe LogStash::Filters::Mutate do
|
|
100
100
|
"survivor" => "Hello.",
|
101
101
|
"one" => { "two" => "wee" }
|
102
102
|
) do
|
103
|
-
|
104
|
-
|
105
|
-
|
106
|
-
|
107
|
-
|
103
|
+
expect(subject["survivor"]).to eq "Hello."
|
104
|
+
|
105
|
+
expect(subject).not_to include("remove-me")
|
106
|
+
expect(subject).not_to include("remove-me2")
|
107
|
+
expect(subject).not_to include("diedie")
|
108
|
+
expect(subject["one"]).not_to include("two")
|
108
109
|
end
|
109
110
|
end
|
110
111
|
|
@@ -117,7 +118,7 @@ describe LogStash::Filters::Mutate do
|
|
117
118
|
}'
|
118
119
|
|
119
120
|
sample("unicorns" => 1234) do
|
120
|
-
|
121
|
+
expect(subject["unicorns"]).to eq "1234"
|
121
122
|
end
|
122
123
|
end
|
123
124
|
|
@@ -176,7 +177,7 @@ describe LogStash::Filters::Mutate do
|
|
176
177
|
}'
|
177
178
|
|
178
179
|
sample("unicorns" => "Magnificient, but extinct, animals") do
|
179
|
-
|
180
|
+
expect(subject["unicorns"]).to eq "Magnificient, and common, animals"
|
180
181
|
end
|
181
182
|
end
|
182
183
|
|
@@ -191,7 +192,7 @@ describe LogStash::Filters::Mutate do
|
|
191
192
|
sample("unicorns" => [
|
192
193
|
"Magnificient extinct animals", "Other extinct ideas" ]
|
193
194
|
) do
|
194
|
-
|
195
|
+
expect(subject["unicorns"]).to eq [
|
195
196
|
"Magnificient common animals",
|
196
197
|
"Other common ideas"
|
197
198
|
]
|
@@ -208,8 +209,8 @@ describe LogStash::Filters::Mutate do
|
|
208
209
|
}'
|
209
210
|
|
210
211
|
sample("colors" => "One red car", "shapes" => "Four red squares") do
|
211
|
-
|
212
|
-
|
212
|
+
expect(subject["colors"]).to eq "One blue car"
|
213
|
+
expect(subject["shapes"]).to eq "Four red circles"
|
213
214
|
end
|
214
215
|
end
|
215
216
|
|
@@ -222,7 +223,7 @@ describe LogStash::Filters::Mutate do
|
|
222
223
|
}'
|
223
224
|
|
224
225
|
sample("colors" => "red3") do
|
225
|
-
|
226
|
+
expect(subject["colors"]).to eq "redblue"
|
226
227
|
end
|
227
228
|
end
|
228
229
|
|
@@ -239,7 +240,7 @@ describe LogStash::Filters::Mutate do
|
|
239
240
|
CONFIG
|
240
241
|
|
241
242
|
sample "HELLO WORLD" do
|
242
|
-
|
243
|
+
expect(subject["foo"]).to eq "hello"
|
243
244
|
end
|
244
245
|
end
|
245
246
|
|
@@ -253,8 +254,8 @@ describe LogStash::Filters::Mutate do
|
|
253
254
|
CONFIG
|
254
255
|
|
255
256
|
sample "whatever" do
|
256
|
-
|
257
|
-
|
257
|
+
expect(subject).not_to include("nosuchfield")
|
258
|
+
expect(subject).not_to include("hello")
|
258
259
|
end
|
259
260
|
end
|
260
261
|
|
@@ -268,8 +269,8 @@ describe LogStash::Filters::Mutate do
|
|
268
269
|
CONFIG
|
269
270
|
|
270
271
|
sample({ "foo" => { "bar" => "1000" } }) do
|
271
|
-
|
272
|
-
|
272
|
+
expect(subject["[foo][bar]"]).to eq 1000
|
273
|
+
expect(subject["[foo][bar]"]).to be_a(Fixnum)
|
273
274
|
end
|
274
275
|
end
|
275
276
|
|
@@ -283,8 +284,8 @@ describe LogStash::Filters::Mutate do
|
|
283
284
|
CONFIG
|
284
285
|
|
285
286
|
sample({ "foo" => ["100", "200"] }) do
|
286
|
-
|
287
|
-
|
287
|
+
expect(subject["[foo][0]"]).to eq 100
|
288
|
+
expect(subject["[foo][0]"]).to be_a(Fixnum)
|
288
289
|
end
|
289
290
|
end
|
290
291
|
|
@@ -298,7 +299,7 @@ describe LogStash::Filters::Mutate do
|
|
298
299
|
}'
|
299
300
|
|
300
301
|
sample("unicorns" => "Unicorns of type blue are common", "unicorn_type" => "blue") do
|
301
|
-
|
302
|
+
expect(subject["unicorns"]).to eq "Unicorns green are common"
|
302
303
|
end
|
303
304
|
end
|
304
305
|
|
@@ -312,7 +313,7 @@ describe LogStash::Filters::Mutate do
|
|
312
313
|
}'
|
313
314
|
|
314
315
|
sample("unicorns2" => "Unicorns of type blue are common", "unicorn_color" => "blue") do
|
315
|
-
|
316
|
+
expect(subject["unicorns2"]).to eq "Unicorns blue and green are common"
|
316
317
|
end
|
317
318
|
end
|
318
319
|
|
@@ -329,7 +330,7 @@ describe LogStash::Filters::Mutate do
|
|
329
330
|
"Unicorns of type blue are found in Alaska", "Unicorns of type blue are extinct" ],
|
330
331
|
"color" => "blue"
|
331
332
|
) do
|
332
|
-
|
333
|
+
expect(subject["unicorns_array"]).to eq [
|
333
334
|
"Unicorns blue and green are found in Alaska",
|
334
335
|
"Unicorns blue and green are extinct"
|
335
336
|
]
|
@@ -345,8 +346,8 @@ describe LogStash::Filters::Mutate do
|
|
345
346
|
}'
|
346
347
|
|
347
348
|
sample("foo" => "bar") do
|
348
|
-
|
349
|
-
|
349
|
+
expect(subject["list"]).to eq ["bar"]
|
350
|
+
expect(subject["foo"]).to eq "bar"
|
350
351
|
end
|
351
352
|
end
|
352
353
|
|
@@ -359,8 +360,8 @@ describe LogStash::Filters::Mutate do
|
|
359
360
|
}'
|
360
361
|
|
361
362
|
sample("foo" => "bar", "list" => []) do
|
362
|
-
|
363
|
-
|
363
|
+
expect(subject["list"]).to eq ["bar"]
|
364
|
+
expect(subject["foo"]).to eq "bar"
|
364
365
|
end
|
365
366
|
end
|
366
367
|
|
@@ -373,8 +374,8 @@ describe LogStash::Filters::Mutate do
|
|
373
374
|
}'
|
374
375
|
|
375
376
|
sample("foo" => "bar", "list" => ["baz"]) do
|
376
|
-
|
377
|
-
|
377
|
+
expect(subject["list"]).to eq ["baz", "bar"]
|
378
|
+
expect(subject["foo"]).to eq "bar"
|
378
379
|
end
|
379
380
|
end
|
380
381
|
|
@@ -387,8 +388,8 @@ describe LogStash::Filters::Mutate do
|
|
387
388
|
}'
|
388
389
|
|
389
390
|
sample("foo" => ["bar"], "list" => ["baz"]) do
|
390
|
-
|
391
|
-
|
391
|
+
expect(subject["list"]).to eq ["baz", "bar"]
|
392
|
+
expect(subject["foo"]).to eq ["bar"]
|
392
393
|
end
|
393
394
|
end
|
394
395
|
|
@@ -401,8 +402,8 @@ describe LogStash::Filters::Mutate do
|
|
401
402
|
}'
|
402
403
|
|
403
404
|
sample("foo" => [], "list" => ["baz"]) do
|
404
|
-
|
405
|
-
|
405
|
+
expect(subject["list"]).to eq ["baz"]
|
406
|
+
expect(subject["foo"]).to eq []
|
406
407
|
end
|
407
408
|
end
|
408
409
|
|
@@ -415,8 +416,8 @@ describe LogStash::Filters::Mutate do
|
|
415
416
|
}'
|
416
417
|
|
417
418
|
sample("foo" => ["bar"], "list" => "baz") do
|
418
|
-
|
419
|
-
|
419
|
+
expect(subject["list"]).to eq ["baz", "bar"]
|
420
|
+
expect(subject["foo"]).to eq ["bar"]
|
420
421
|
end
|
421
422
|
end
|
422
423
|
|
@@ -429,8 +430,8 @@ describe LogStash::Filters::Mutate do
|
|
429
430
|
}'
|
430
431
|
|
431
432
|
sample("foo" => "bar", "list" => "baz") do
|
432
|
-
|
433
|
-
|
433
|
+
expect(subject["list"]).to eq ["baz", "bar"]
|
434
|
+
expect(subject["foo"]).to eq "bar"
|
434
435
|
end
|
435
436
|
end
|
436
437
|
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-filter-mutate
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.0.
|
4
|
+
version: 1.0.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2015-
|
11
|
+
date: 2015-08-14 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: logstash-core
|
@@ -88,6 +88,7 @@ files:
|
|
88
88
|
- Rakefile
|
89
89
|
- lib/logstash/filters/mutate.rb
|
90
90
|
- logstash-filter-mutate.gemspec
|
91
|
+
- spec/filters/integration/multi_stage_spec.rb
|
91
92
|
- spec/filters/mutate_spec.rb
|
92
93
|
homepage: http://www.elastic.co/guide/en/logstash/current/index.html
|
93
94
|
licenses:
|
@@ -111,9 +112,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
111
112
|
version: '0'
|
112
113
|
requirements: []
|
113
114
|
rubyforge_project:
|
114
|
-
rubygems_version: 2.
|
115
|
+
rubygems_version: 2.1.9
|
115
116
|
signing_key:
|
116
117
|
specification_version: 4
|
117
118
|
summary: The mutate filter allows you to perform general mutations on fields. You can rename, remove, replace, and modify fields in your events.
|
118
119
|
test_files:
|
120
|
+
- spec/filters/integration/multi_stage_spec.rb
|
119
121
|
- spec/filters/mutate_spec.rb
|