logstash-filter-rfc2047 0.2.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 694b1fd01156cf5da073d94c35931abaaceb49f2
+  data.tar.gz: 47d1236583ce5b98a8615162279e48164f54e3a0
+SHA512:
+  metadata.gz: 86e6503f04c46f050d93016f74a0251e954bc5f117f6e5c0e2402912e82c211adbd279776f49571c0a431f5b7a409beeb9bb7c36ae3f1161b52744fdfa0fb4e3
+  data.tar.gz: a7e6a7a7e5454734077fc2b6a03a2e41ad8d19d2f1c3ce726810f557dd9087dd78d5d33900f261d5415b133c3ac1ff074f5440a92fd221699af851041e57ed85

data/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gemspec

data/LICENSE

@@ -0,0 +1,11 @@
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

data/NOTICE.TXT

@@ -0,0 +1,5 @@
+Elasticsearch
+Copyright 2012-2015 Elasticsearch
+
+This product includes software developed by The Apache Software
+Foundation (http://www.apache.org/).

data/README.md

@@ -0,0 +1,36 @@
+# Logstash RFC2407 Plugin
+
+[![Travis Build Status](https://travis-ci.org/logstash-plugins/logstash-filter-example.svg)](https://travis-ci.org/logstash-plugins/logstash-filter-example)
+
+This plugin is meant for decoding RFC2047 headers
+
+## Example
+
+* with the message given:
+
+```
+message => "2013-01-20T13:14:01+0000: Example mail header field: =?ISO-8859-1?B?SWYgeW91IGNhbiByZWFkIHRoaXMgeW8=?==?ISO-8859-2?B?dSB1bmRlcnN0YW5kIHRoZSBleGFtcGxlLg==?=;"
+```
+
+* and the plugin configuration:
+
+```
+      filter {
+        grok {
+          match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}: %{DATA}: %{DATA:header_field1};( %{GREEDYDATA:header_field2})?"}
+        }
+        mime {
+          field => [ "header_field1", "header_field2" ]
+        }
+      }
+```
+
+* the outcome will be a document:
+
+```
+{
+ @timestamp: "2013-01-20T13:14:01+0000",
+ header_field1: "If you can read this you understand the example."
+}
+```
+

data/lib/logstash/filters/rfc2047.rb

@@ -0,0 +1,33 @@
+# encoding: utf-8
+require "logstash/filters/base"
+require "logstash/namespace"
+require 'rfc2047'
+
+class LogStash::Filters::RFC2047 < LogStash::Filters::Base
+
+ config_name "rfc2047"
+
+ config :field, :validate => :array
+
+  public
+  def register
+    # Add instance variables
+  end # def register
+
+  public
+  def filter(event)
+
+    @field.each do |f| 
+      msg = event[f]
+      if ((msg =~ /=\?((?:ISO|UTF)-[0-9]{1,4}(?:-[0-9])?)\?/i) && (msg.encoding.to_s=="UTF-8"))
+         event[f] = Rfc2047.decode(msg.encode("utf-8"), $1)
+         # correct debugging log statement for reference
+         # using the event.get API
+         @logger.debug? && @logger.debug("Message is now: #{event["message"]})")
+      end
+    end
+
+    # filter_matched should go in the last line of our successful code
+    filter_matched(event)
+  end # def filter
+end 

data/logstash-filter-rfc2047.gemspec

@@ -0,0 +1,26 @@
+Gem::Specification.new do |s|
+  s.name = 'logstash-filter-rfc2047'
+  s.version         = '0.2.1'
+  s.licenses = ['Apache License (2.0)']
+  s.summary = "This plugin decodes the RFC2047 format headers."
+  s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
+  s.authors = ["Tomasz Habiger"]
+  s.email = 'tomasz.habiger@gmail.com'
+  s.homepage = ""
+  s.require_paths = ["lib"]
+
+  # Files
+  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
+   # Tests
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core-plugin-api", "~> 1.0"
+  s.add_runtime_dependency "rfc2047", "~> 0.3"
+  s.add_development_dependency 'logstash-devutils', '~> 0'
+  s.add_development_dependency 'logstash-filter-grok', '~> 3.2'
+  s.add_development_dependency 'logstash-patterns-core', '~> 4.0'
+end

data/spec/filters/rfc2047_spec.rb

@@ -0,0 +1,81 @@
+# encoding: utf-8
+
+require 'spec_helper'
+require "logstash/patterns/core"
+
+# solution based on https://github.com/logstash-plugins/logstash-filter-grok/blob/master/spec/filters/grok_spec.rb
+module LogStash::Environment
+  # running the grok code outside a logstash package means
+  # LOGSTASH_HOME will not be defined, so let's set it here
+  # before requiring the grok filter
+
+  # the path that is set is the plugin root path
+  unless self.const_defined?(:LOGSTASH_HOME)
+    LOGSTASH_HOME = File.expand_path("../../../", __FILE__)
+  end
+
+  # also :pattern_path method must exist so we define it too
+
+  # method is called by logstash-filter-grok to create patterns_path array
+  #
+  #   logstash-filter-grok/lib/logstash/filters/grok.rb(line ~230):
+  #
+  #   @@patterns_path += [
+  #     LogStash::Patterns::Core.path,
+  #     LogStash::Environment.pattern_path("*")
+  #
+  # patterns defined in spec/patterns/ will be joined to the array by the grok 
+
+  unless self.method_defined?(:pattern_path)
+    def pattern_path(path)
+      ::File.join(LOGSTASH_HOME, "spec", "patterns", path)
+    end
+  end
+end
+
+require "logstash/filters/grok"
+require "logstash/filters/rfc2047"
+
+describe "LogStash::Filters::RFC2047" do
+  describe "Encode single RFC2047 field" do
+
+    let(:config) do <<-CONFIG
+      filter {
+        grok {
+          match => { "message" => "%{TIMESTAMP}: %{DATA}: %{DATA:header_field1}: %{GREEDYDATA:header_field2}" }
+        }
+        rfc2047 {
+          field => [ "header_field1", "header_field2", "header_field3" ]
+        }
+      }
+      CONFIG
+    end
+    
+    describe "Decode valid messages" do
+
+      message = "2013-01-20T13:14:01+0000: Example mail header field: =?ISO-8859-1?B?SWYgeW91IGNhbiByZWFkIHRoaXMgeW8=?==?ISO-8859-2?B?dSB1bmRlcnN0YW5kIHRoZSBleGFtcGxlLg==?=: =?ISO-8859-2?B?VGhlIHNlY29uZCBtZXNzYWdl=?="
+
+      sample ({
+                'message' => message,
+                'type' => 'type'
+      }) do
+        insist { subject["header_field1"] } == "If you can read this you understand the example."
+        insist { subject["header_field2"] } == "The second message"
+      end
+    end
+
+    describe "Invalid message should pass through unchanged" do
+
+      message = "2013-01-20T13:14:01+0000: Example mail header field: =?ISO-8859-1?B?SWYgeW91IGNhbiByZWFkIHRoaXMgeW8=?==?ISO-8859-2?B?dSB1bmRlcnN0YW5kIHRoZSBleGFtcGxlLg==?=: =?iso-2022-jp?Q?whatever"
+
+      sample ({
+                'message' => message,
+                'type' => 'type'
+      }) do
+        insist { subject["header_field1"] } == "If you can read this you understand the example."
+        insist { subject["header_field2"] } == "=?iso-2022-jp?Q?whatever"
+      end
+    end
+
+  end
+end

data/spec/patterns/local

@@ -0,0 +1 @@
+TIMESTAMP %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?

data/spec/spec_helper.rb

@@ -0,0 +1,2 @@
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"

metadata

@@ -0,0 +1,129 @@
+--- !ruby/object:Gem::Specification
+name: logstash-filter-rfc2047
+version: !ruby/object:Gem::Version
+  version: 0.2.1
+platform: ruby
+authors:
+- Tomasz Habiger
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2016-12-18 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: logstash-core-plugin-api
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: rfc2047
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
+- !ruby/object:Gem::Dependency
+  name: logstash-devutils
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: logstash-filter-grok
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.2'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.2'
+- !ruby/object:Gem::Dependency
+  name: logstash-patterns-core
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+description: This gem is a Logstash plugin required to be installed on top of the
+  Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
+  gem is not a stand-alone program
+email: tomasz.habiger@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- Gemfile
+- LICENSE
+- NOTICE.TXT
+- README.md
+- lib/logstash/filters/rfc2047.rb
+- logstash-filter-rfc2047.gemspec
+- spec/filters/rfc2047_spec.rb
+- spec/patterns/local
+- spec/spec_helper.rb
+homepage: ''
+licenses:
+- Apache License (2.0)
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: filter
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.2
+signing_key: 
+specification_version: 4
+summary: This plugin decodes the RFC2047 format headers.
+test_files:
+- spec/filters/rfc2047_spec.rb
+- spec/patterns/local
+- spec/spec_helper.rb