logstash-filter-prune 3.0.0 → 3.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5ef1690c69edaaf16f57f240c96677c00d86cb95
-  data.tar.gz: 99015b154c7efe6f4d5921041c05ca8ba866718e
+  metadata.gz: 0b06d3ca2d9d6fd300c3f9e78bcfcacacf638b16
+  data.tar.gz: 091aefc03fe5f1ac0557959c01130e4ef237d008
 SHA512:
-  metadata.gz: 03283a46d5f871fccc10fcbb6ce9f57dcf6dca4b4a588dead0297201b75da9525ef33391fd8c4f366e02c88eb6f02f133ebfabf262449238616eb2c0ce2474f0
-  data.tar.gz: 3741c495ba8f040549e38186abf74f98d2d59daa27e931342012a6b0a43727c9b04352a077de2ea6094156c9c4c61763fe171ede89c3adbb7433f2ca31444354
+  metadata.gz: 25a08cb1c3211db98bc2699d9469071a7be3a5634ecae82b313d6bee6a95aad6918cf089aa1c754b5ec8175166f11c231d2fefc56391dee42bb7b5543c065165
+  data.tar.gz: c6330872232aa93ae4961f5727271c1e0eb0d25489ecb2882413a46007080ceff5adf89f58405edf0fe222accffa4ca3270f701dffccb5530d8a592fdac6ac3e

data/Gemfile

@@ -1,2 +1,11 @@
 source 'https://rubygems.org'
-gemspec
+
+gemspec
+
+logstash_path = ENV["LOGSTASH_PATH"] || "../../logstash"
+use_logstash_source = ENV["LOGSTASH_SOURCE"] && ENV["LOGSTASH_SOURCE"].to_s == "1"
+
+if Dir.exist?(logstash_path) && use_logstash_source
+  gem 'logstash-core', :path => "#{logstash_path}/logstash-core"
+  gem 'logstash-core-plugin-api', :path => "#{logstash_path}/logstash-core-plugin-api"
+end

data/docs/index.asciidoc

@@ -0,0 +1,154 @@
+:plugin: prune
+:type: filter
+
+///////////////////////////////////////////
+START - GENERATED VARIABLES, DO NOT EDIT!
+///////////////////////////////////////////
+:version: %VERSION%
+:release_date: %RELEASE_DATE%
+:changelog_url: %CHANGELOG_URL%
+:include_path: ../../../../logstash/docs/include
+///////////////////////////////////////////
+END - GENERATED VARIABLES, DO NOT EDIT!
+///////////////////////////////////////////
+
+[id="plugins-{type}-{plugin}"]
+
+=== Prune filter plugin
+
+include::{include_path}/plugin_header.asciidoc[]
+
+==== Description
+
+The prune filter is for removing fields from events based on
+whitelists or blacklist of field names or their values (names and
+values can also be regular expressions).
+
+This can e.g. be useful if you have a <<plugins-filters-json,json>>
+or <<plugins-filters-kv,kv>> filter that creates a number of fields
+with names that you don't necessarily know the names of beforehand,
+and you only want to keep a subset of them.
+
+Usage help:
+To specify a exact field name or value use the regular expression syntax `^some_name_or_value$`.
+Example usage: Input data `{ "msg":"hello world", "msg_short":"hw" }`
+[source,ruby]
+    filter {
+      prune {
+        whitelist_names => [ "msg" ]
+      }
+    }
+Allows both `"msg"` and `"msg_short"` through.
+
+While:
+[source,ruby]
+    filter {
+      prune {
+        whitelist_names => ["^msg$"]
+      }
+    }
+Allows only `"msg"` through.
+
+Logstash stores an event's `tags` as a field which is subject to pruning. Remember to `whitelist_names => [ "^tags$" ]`
+to maintain `tags` after pruning or use `blacklist_values => [ "^tag_name$" ]` to eliminate a specific `tag`.
+
+NOTE: This filter currently only support operations on top-level fields,
+i.e. whitelisting and blacklisting of subfields based on name or value
+does not work.
+
+[id="plugins-{type}s-{plugin}-options"]
+==== Prune Filter Configuration Options
+
+This plugin supports the following configuration options plus the <<plugins-{type}s-{plugin}-common-options>> described later.
+
+[cols="<,<,<",options="header",]
+|=======================================================================
+|Setting |Input type|Required
+| <<plugins-{type}s-{plugin}-blacklist_names>> |<<array,array>>|No
+| <<plugins-{type}s-{plugin}-blacklist_values>> |<<hash,hash>>|No
+| <<plugins-{type}s-{plugin}-interpolate>> |<<boolean,boolean>>|No
+| <<plugins-{type}s-{plugin}-whitelist_names>> |<<array,array>>|No
+| <<plugins-{type}s-{plugin}-whitelist_values>> |<<hash,hash>>|No
+|=======================================================================
+
+Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
+filter plugins.
+
+&nbsp;
+
+[id="plugins-{type}s-{plugin}-blacklist_names"]
+===== `blacklist_names` 
+
+  * Value type is <<array,array>>
+  * Default value is `["%{[^}]+}"]`
+
+Exclude fields whose names match specified regexps, by default exclude unresolved `%{field}` strings.
+[source,ruby]
+    filter {
+      prune {
+        blacklist_names => [ "method", "(referrer|status)", "${some}_field" ]
+      }
+    }
+
+[id="plugins-{type}s-{plugin}-blacklist_values"]
+===== `blacklist_values` 
+
+  * Value type is <<hash,hash>>
+  * Default value is `{}`
+
+Exclude specified fields if their values match one of the supplied regular expressions.
+In case field values are arrays, each array item is matched against the regular expressions and matching array items will be excluded.
+[source,ruby]
+    filter {
+      prune {
+        blacklist_values => [ "uripath", "/index.php",
+                              "method", "(HEAD|OPTIONS)",
+                              "status", "^[^2]" ]
+      }
+    }
+
+[id="plugins-{type}s-{plugin}-interpolate"]
+===== `interpolate` 
+
+  * Value type is <<boolean,boolean>>
+  * Default value is `false`
+
+Trigger whether configuration fields and values should be interpolated for
+dynamic values (when resolving `%{some_field}`).
+Probably adds some performance overhead. Defaults to false.
+
+[id="plugins-{type}s-{plugin}-whitelist_names"]
+===== `whitelist_names` 
+
+  * Value type is <<array,array>>
+  * Default value is `[]`
+
+Include only fields only if their names match specified regexps, default to empty list which means include everything.
+[source,ruby]
+    filter {
+      prune {
+        whitelist_names => [ "method", "(referrer|status)", "${some}_field" ]
+      }
+    }
+
+[id="plugins-{type}s-{plugin}-whitelist_values"]
+===== `whitelist_values` 
+
+  * Value type is <<hash,hash>>
+  * Default value is `{}`
+
+Include specified fields only if their values match one of the supplied regular expressions.
+In case field values are arrays, each array item is matched against the regular expressions and only matching array items will be included.
+[source,ruby]
+    filter {
+      prune {
+        whitelist_values => [ "uripath", "/index.php",
+                              "method", "(GET|POST)",
+                              "status", "^[^2]" ]
+      }
+    }
+
+
+
+[id="plugins-{type}s-{plugin}-common-options"]
+include::{include_path}/{type}.asciidoc[]

data/logstash-filter-prune.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-prune'
-  s.version         = '3.0.0'
+  s.version         = '3.0.1'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "The prune filter is for pruning event data from fields based on whitelist/blacklist of field names or their values (names and values can also be regular expressions)"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
@@ -11,7 +11,7 @@ Gem::Specification.new do |s|
   s.require_paths = ["lib"]
 
   # Files
-  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
+  s.files = Dir["lib/**/*","spec/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "vendor/jar-dependencies/**/*.jar", "vendor/jar-dependencies/**/*.rb", "VERSION", "docs/**/*"]
 
   # Tests
   s.test_files = s.files.grep(%r{^(test|spec|features)/})

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-prune
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.0.1
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2017-01-04 00:00:00.000000000 Z
+date: 2017-06-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -56,6 +56,7 @@ files:
 - LICENSE
 - NOTICE.TXT
 - README.md
+- docs/index.asciidoc
 - lib/logstash/filters/prune.rb
 - logstash-filter-prune.gemspec
 - spec/filters/prune_spec.rb