logstash-filter-phpserialized 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 7e0abfc15c2f8469a0f46d6cbc1d854ee97c27b4
+  data.tar.gz: 1be8ff2ff35bb546dd0a3eb36a8fbd30d3f595a4
+SHA512:
+  metadata.gz: 010a9ea631f60e0eeca8610f48e9bce49a92d17762d02349b867c5aa0da357a1d35b5178f20264c87b08af0d1c58358551039c6ef8aed805a1bb80d967a18832
+  data.tar.gz: 0ce94f79c74350b7ed7d1366ffa7b5a2f31504c5f05ac884c58080c8ddf47e802c794daa467455aaf619df118e869a508a15e4a8d284fc4d5cb423869b64e266

data/CHANGELOG.md

@@ -0,0 +1,2 @@
+## 0.1.0
+

data/CONTRIBUTORS

@@ -0,0 +1,11 @@
+The following is a list of people who have contributed ideas, code, bug
+reports, or in general have helped logstash along its way.
+
+Contributors:
+* Aaron Mildenstein (untergeek)
+* Pier-Hugues Pellerin (ph)
+
+Note: If you've sent us patches, bug reports, or otherwise contributed to
+Logstash, and you aren't on the list above and want to be, please let us know
+and we'll make sure you're here. Contributions from folks like you are what make
+open source awesome.

data/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+gemspec
+gem 'php-serialization', '~> 0.5.3'

data/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2012–2015 Elasticsearch <http://www.elastic.co>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

data/NOTICE.TXT

@@ -0,0 +1,5 @@
+Elasticsearch
+Copyright 2012-2015 Elasticsearch
+
+This product includes software developed by The Apache Software
+Foundation (http://www.apache.org/).

data/README.md

@@ -0,0 +1,45 @@
+# Logstash Plugin PHPSerialized
+
+This is a plugin for [Logstash](https://github.com/elastic/logstash).
+
+It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.
+
+## Need Help?
+
+Need help? Try #logstash on freenode IRC or the https://discuss.elastic.co/c/logstash discussion forum.
+
+## Developing
+
+### 1. Plugin Developement and Testing
+
+#### Test
+
+- Update your dependencies
+
+```sh
+bundle install
+```
+
+- Run tests
+
+```sh
+bundle exec rspec
+```
+
+### 2. Running your unpublished Plugin in Logstash
+
+#### 2.1 Run in a local Logstash clone
+
+- Edit Logstash `Gemfile` and add the local plugin path, for example:
+```ruby
+gem "logstash-filter-phpserialized", :path => "/your/local/logstash-filter-phpserialized"
+```
+- Install plugin
+```sh
+bin/plugin install --no-verify
+```
+- Run Logstash with your plugin
+```sh
+bin/logstash -e 'filter {phpserialized {}}'
+```
+At this point any modifications to the plugin code will be applied to this local Logstash setup. After modifying the plugin, simply rerun Logstash.

data/lib/logstash/filters/phpserialized.rb

@@ -0,0 +1,35 @@
+# encoding: utf-8
+require "logstash/filters/base"
+require "logstash/namespace"
+require "php_serialization"
+
+class LogStash::Filters::PHPSerialized < LogStash::Filters::Base
+
+  config_name "phpserialized"
+
+  # Replace the message with this value.
+  config :target, :validate => :string, :default => "message"
+  config :source, :validate => :string, :default => "message"
+
+
+  public
+  def register
+  end
+
+
+  public
+  def filter(event)
+
+    value = event[@source]
+    unless value.empty?
+      begin
+        data = PhpSerialization.load(value.gsub(/O:8:"stdClass"/, 'O:8:"StdClass"'))
+        event["[#{@target}]"] = data
+      rescue
+        @logger.warn("phpunserialized failed to unserialize")
+      end
+    end
+
+    filter_matched(event)
+  end
+end

data/logstash-filter-phpserialized.gemspec

@@ -0,0 +1,24 @@
+Gem::Specification.new do |s|
+  s.name = 'logstash-filter-phpserialized'
+  s.version = '0.1.0'
+  s.licenses = ['Apache License (2.0)']
+  s.summary = "unserialize php serialized data"
+  s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
+  s.authors = ["mhoffmann"]
+  s.email = 'info@elastic.co'
+  s.homepage = "https://github.com/mhoffmann/logstash-filter-phpserialized"
+  s.require_paths = ["lib"]
+
+  # Files
+  s.files = Dir['lib/**/*', 'spec/**/*', 'vendor/**/*', '*.gemspec', '*.md', 'CONTRIBUTORS', 'Gemfile', 'LICENSE', 'NOTICE.TXT']
+  # Tests
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = {"logstash_plugin" => "true", "logstash_group" => "filter"}
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core", ">= 2.0.0", "< 3.0.0"
+  s.add_runtime_dependency 'php-serialization', '~> 0.5.3'
+  s.add_development_dependency 'logstash-devutils'
+end

data/spec/filters/phpserialized_spec.rb

@@ -0,0 +1,40 @@
+# encoding: utf-8
+require 'spec_helper'
+require 'logstash/filters/phpserialized'
+
+describe LogStash::Filters::PHPSerialized do
+  describe "unserialize something" do
+    let(:config) do
+      <<-CONFIG
+      filter {
+        phpserialized {
+          target => "t"
+          source => "s"
+        }
+      }
+      CONFIG
+    end
+
+    #php > echo serialize([true, 0.1, 1, "test" => "test", null, (object)["a" => "b"]]);
+    sample('s' => 'a:6:{i:0;b:1;i:1;d:0.10000000000000001;i:2;i:1;s:4:"test";s:4:"test";i:3;N;i:4;O:8:"stdClass":1:{s:1:"a";s:1:"b";}}') do
+      expect(subject).to include('t')
+      expect(subject['[t][test]']).to eq('test')
+    end
+
+    sample("s" => "") do
+      expect(subject).to_not include('t')
+    end
+  end
+  describe "test default config" do
+    let(:config) do
+      <<-CONFIG
+      filter { phpserialized {} }
+      CONFIG
+    end
+
+    #php > echo serialize(["test" => "test"]);
+    sample('message' => 'a:1:{s:4:"test";s:4:"test";}') do
+      expect(subject['[message][test]']).to eq('test')
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,2 @@
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"

metadata

@@ -0,0 +1,105 @@
+--- !ruby/object:Gem::Specification
+name: logstash-filter-phpserialized
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- mhoffmann
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2016-03-16 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: 2.0.0
+    - - <
+      - !ruby/object:Gem::Version
+        version: 3.0.0
+  name: logstash-core
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: 2.0.0
+    - - <
+      - !ruby/object:Gem::Version
+        version: 3.0.0
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.5.3
+  name: php-serialization
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.5.3
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  name: logstash-devutils
+  prerelease: false
+  type: :development
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+description: This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program
+email: info@elastic.co
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- CONTRIBUTORS
+- Gemfile
+- LICENSE
+- NOTICE.TXT
+- README.md
+- lib/logstash/filters/phpserialized.rb
+- logstash-filter-phpserialized.gemspec
+- spec/filters/phpserialized_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/mhoffmann/logstash-filter-phpserialized
+licenses:
+- Apache License (2.0)
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: filter
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project:
+rubygems_version: 2.4.5
+signing_key:
+specification_version: 4
+summary: unserialize php serialized data
+test_files:
+- spec/filters/phpserialized_spec.rb
+- spec/spec_helper.rb