logstash-filter-rfc2047 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +7 -0
- data/Gemfile +2 -0
- data/LICENSE +11 -0
- data/NOTICE.TXT +5 -0
- data/README.md +36 -0
- data/lib/logstash/filters/rfc2047.rb +33 -0
- data/logstash-filter-rfc2047.gemspec +26 -0
- data/spec/filters/rfc2047_spec.rb +81 -0
- data/spec/patterns/local +1 -0
- data/spec/spec_helper.rb +2 -0
- metadata +129 -0
checksums.yaml
ADDED
@@ -0,0 +1,7 @@
|
|
1
|
+
---
|
2
|
+
SHA1:
|
3
|
+
metadata.gz: 694b1fd01156cf5da073d94c35931abaaceb49f2
|
4
|
+
data.tar.gz: 47d1236583ce5b98a8615162279e48164f54e3a0
|
5
|
+
SHA512:
|
6
|
+
metadata.gz: 86e6503f04c46f050d93016f74a0251e954bc5f117f6e5c0e2402912e82c211adbd279776f49571c0a431f5b7a409beeb9bb7c36ae3f1161b52744fdfa0fb4e3
|
7
|
+
data.tar.gz: a7e6a7a7e5454734077fc2b6a03a2e41ad8d19d2f1c3ce726810f557dd9087dd78d5d33900f261d5415b133c3ac1ff074f5440a92fd221699af851041e57ed85
|
data/Gemfile
ADDED
data/LICENSE
ADDED
@@ -0,0 +1,11 @@
|
|
1
|
+
Licensed under the Apache License, Version 2.0 (the "License");
|
2
|
+
you may not use this file except in compliance with the License.
|
3
|
+
You may obtain a copy of the License at
|
4
|
+
|
5
|
+
http://www.apache.org/licenses/LICENSE-2.0
|
6
|
+
|
7
|
+
Unless required by applicable law or agreed to in writing, software
|
8
|
+
distributed under the License is distributed on an "AS IS" BASIS,
|
9
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
10
|
+
See the License for the specific language governing permissions and
|
11
|
+
limitations under the License.
|
data/NOTICE.TXT
ADDED
data/README.md
ADDED
@@ -0,0 +1,36 @@
|
|
1
|
+
# Logstash RFC2407 Plugin
|
2
|
+
|
3
|
+
[](https://travis-ci.org/logstash-plugins/logstash-filter-example)
|
4
|
+
|
5
|
+
This plugin is meant for decoding RFC2047 headers
|
6
|
+
|
7
|
+
## Example
|
8
|
+
|
9
|
+
* with the message given:
|
10
|
+
|
11
|
+
```
|
12
|
+
message => "2013-01-20T13:14:01+0000: Example mail header field: =?ISO-8859-1?B?SWYgeW91IGNhbiByZWFkIHRoaXMgeW8=?==?ISO-8859-2?B?dSB1bmRlcnN0YW5kIHRoZSBleGFtcGxlLg==?=;"
|
13
|
+
```
|
14
|
+
|
15
|
+
* and the plugin configuration:
|
16
|
+
|
17
|
+
```
|
18
|
+
filter {
|
19
|
+
grok {
|
20
|
+
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}: %{DATA}: %{DATA:header_field1};( %{GREEDYDATA:header_field2})?"}
|
21
|
+
}
|
22
|
+
mime {
|
23
|
+
field => [ "header_field1", "header_field2" ]
|
24
|
+
}
|
25
|
+
}
|
26
|
+
```
|
27
|
+
|
28
|
+
* the outcome will be a document:
|
29
|
+
|
30
|
+
```
|
31
|
+
{
|
32
|
+
@timestamp: "2013-01-20T13:14:01+0000",
|
33
|
+
header_field1: "If you can read this you understand the example."
|
34
|
+
}
|
35
|
+
```
|
36
|
+
|
@@ -0,0 +1,33 @@
|
|
1
|
+
# encoding: utf-8
|
2
|
+
require "logstash/filters/base"
|
3
|
+
require "logstash/namespace"
|
4
|
+
require 'rfc2047'
|
5
|
+
|
6
|
+
class LogStash::Filters::RFC2047 < LogStash::Filters::Base
|
7
|
+
|
8
|
+
config_name "rfc2047"
|
9
|
+
|
10
|
+
config :field, :validate => :array
|
11
|
+
|
12
|
+
public
|
13
|
+
def register
|
14
|
+
# Add instance variables
|
15
|
+
end # def register
|
16
|
+
|
17
|
+
public
|
18
|
+
def filter(event)
|
19
|
+
|
20
|
+
@field.each do |f|
|
21
|
+
msg = event[f]
|
22
|
+
if ((msg =~ /=\?((?:ISO|UTF)-[0-9]{1,4}(?:-[0-9])?)\?/i) && (msg.encoding.to_s=="UTF-8"))
|
23
|
+
event[f] = Rfc2047.decode(msg.encode("utf-8"), $1)
|
24
|
+
# correct debugging log statement for reference
|
25
|
+
# using the event.get API
|
26
|
+
@logger.debug? && @logger.debug("Message is now: #{event["message"]})")
|
27
|
+
end
|
28
|
+
end
|
29
|
+
|
30
|
+
# filter_matched should go in the last line of our successful code
|
31
|
+
filter_matched(event)
|
32
|
+
end # def filter
|
33
|
+
end
|
@@ -0,0 +1,26 @@
|
|
1
|
+
Gem::Specification.new do |s|
|
2
|
+
s.name = 'logstash-filter-rfc2047'
|
3
|
+
s.version = '0.2.1'
|
4
|
+
s.licenses = ['Apache License (2.0)']
|
5
|
+
s.summary = "This plugin decodes the RFC2047 format headers."
|
6
|
+
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
7
|
+
s.authors = ["Tomasz Habiger"]
|
8
|
+
s.email = 'tomasz.habiger@gmail.com'
|
9
|
+
s.homepage = ""
|
10
|
+
s.require_paths = ["lib"]
|
11
|
+
|
12
|
+
# Files
|
13
|
+
s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
|
14
|
+
# Tests
|
15
|
+
s.test_files = s.files.grep(%r{^(test|spec|features)/})
|
16
|
+
|
17
|
+
# Special flag to let us know this is actually a logstash plugin
|
18
|
+
s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
|
19
|
+
|
20
|
+
# Gem dependencies
|
21
|
+
s.add_runtime_dependency "logstash-core-plugin-api", "~> 1.0"
|
22
|
+
s.add_runtime_dependency "rfc2047", "~> 0.3"
|
23
|
+
s.add_development_dependency 'logstash-devutils', '~> 0'
|
24
|
+
s.add_development_dependency 'logstash-filter-grok', '~> 3.2'
|
25
|
+
s.add_development_dependency 'logstash-patterns-core', '~> 4.0'
|
26
|
+
end
|
@@ -0,0 +1,81 @@
|
|
1
|
+
# encoding: utf-8
|
2
|
+
|
3
|
+
require 'spec_helper'
|
4
|
+
require "logstash/patterns/core"
|
5
|
+
|
6
|
+
# solution based on https://github.com/logstash-plugins/logstash-filter-grok/blob/master/spec/filters/grok_spec.rb
|
7
|
+
module LogStash::Environment
|
8
|
+
# running the grok code outside a logstash package means
|
9
|
+
# LOGSTASH_HOME will not be defined, so let's set it here
|
10
|
+
# before requiring the grok filter
|
11
|
+
|
12
|
+
# the path that is set is the plugin root path
|
13
|
+
unless self.const_defined?(:LOGSTASH_HOME)
|
14
|
+
LOGSTASH_HOME = File.expand_path("../../../", __FILE__)
|
15
|
+
end
|
16
|
+
|
17
|
+
# also :pattern_path method must exist so we define it too
|
18
|
+
|
19
|
+
# method is called by logstash-filter-grok to create patterns_path array
|
20
|
+
#
|
21
|
+
# logstash-filter-grok/lib/logstash/filters/grok.rb(line ~230):
|
22
|
+
#
|
23
|
+
# @@patterns_path += [
|
24
|
+
# LogStash::Patterns::Core.path,
|
25
|
+
# LogStash::Environment.pattern_path("*")
|
26
|
+
#
|
27
|
+
# patterns defined in spec/patterns/ will be joined to the array by the grok
|
28
|
+
|
29
|
+
unless self.method_defined?(:pattern_path)
|
30
|
+
def pattern_path(path)
|
31
|
+
::File.join(LOGSTASH_HOME, "spec", "patterns", path)
|
32
|
+
end
|
33
|
+
end
|
34
|
+
end
|
35
|
+
|
36
|
+
require "logstash/filters/grok"
|
37
|
+
require "logstash/filters/rfc2047"
|
38
|
+
|
39
|
+
describe "LogStash::Filters::RFC2047" do
|
40
|
+
describe "Encode single RFC2047 field" do
|
41
|
+
|
42
|
+
let(:config) do <<-CONFIG
|
43
|
+
filter {
|
44
|
+
grok {
|
45
|
+
match => { "message" => "%{TIMESTAMP}: %{DATA}: %{DATA:header_field1}: %{GREEDYDATA:header_field2}" }
|
46
|
+
}
|
47
|
+
rfc2047 {
|
48
|
+
field => [ "header_field1", "header_field2", "header_field3" ]
|
49
|
+
}
|
50
|
+
}
|
51
|
+
CONFIG
|
52
|
+
end
|
53
|
+
|
54
|
+
describe "Decode valid messages" do
|
55
|
+
|
56
|
+
message = "2013-01-20T13:14:01+0000: Example mail header field: =?ISO-8859-1?B?SWYgeW91IGNhbiByZWFkIHRoaXMgeW8=?==?ISO-8859-2?B?dSB1bmRlcnN0YW5kIHRoZSBleGFtcGxlLg==?=: =?ISO-8859-2?B?VGhlIHNlY29uZCBtZXNzYWdl=?="
|
57
|
+
|
58
|
+
sample ({
|
59
|
+
'message' => message,
|
60
|
+
'type' => 'type'
|
61
|
+
}) do
|
62
|
+
insist { subject["header_field1"] } == "If you can read this you understand the example."
|
63
|
+
insist { subject["header_field2"] } == "The second message"
|
64
|
+
end
|
65
|
+
end
|
66
|
+
|
67
|
+
describe "Invalid message should pass through unchanged" do
|
68
|
+
|
69
|
+
message = "2013-01-20T13:14:01+0000: Example mail header field: =?ISO-8859-1?B?SWYgeW91IGNhbiByZWFkIHRoaXMgeW8=?==?ISO-8859-2?B?dSB1bmRlcnN0YW5kIHRoZSBleGFtcGxlLg==?=: =?iso-2022-jp?Q?whatever"
|
70
|
+
|
71
|
+
sample ({
|
72
|
+
'message' => message,
|
73
|
+
'type' => 'type'
|
74
|
+
}) do
|
75
|
+
insist { subject["header_field1"] } == "If you can read this you understand the example."
|
76
|
+
insist { subject["header_field2"] } == "=?iso-2022-jp?Q?whatever"
|
77
|
+
end
|
78
|
+
end
|
79
|
+
|
80
|
+
end
|
81
|
+
end
|
data/spec/patterns/local
ADDED
@@ -0,0 +1 @@
|
|
1
|
+
TIMESTAMP %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?
|
data/spec/spec_helper.rb
ADDED
metadata
ADDED
@@ -0,0 +1,129 @@
|
|
1
|
+
--- !ruby/object:Gem::Specification
|
2
|
+
name: logstash-filter-rfc2047
|
3
|
+
version: !ruby/object:Gem::Version
|
4
|
+
version: 0.2.1
|
5
|
+
platform: ruby
|
6
|
+
authors:
|
7
|
+
- Tomasz Habiger
|
8
|
+
autorequire:
|
9
|
+
bindir: bin
|
10
|
+
cert_chain: []
|
11
|
+
date: 2016-12-18 00:00:00.000000000 Z
|
12
|
+
dependencies:
|
13
|
+
- !ruby/object:Gem::Dependency
|
14
|
+
name: logstash-core-plugin-api
|
15
|
+
requirement: !ruby/object:Gem::Requirement
|
16
|
+
requirements:
|
17
|
+
- - "~>"
|
18
|
+
- !ruby/object:Gem::Version
|
19
|
+
version: '1.0'
|
20
|
+
type: :runtime
|
21
|
+
prerelease: false
|
22
|
+
version_requirements: !ruby/object:Gem::Requirement
|
23
|
+
requirements:
|
24
|
+
- - "~>"
|
25
|
+
- !ruby/object:Gem::Version
|
26
|
+
version: '1.0'
|
27
|
+
- !ruby/object:Gem::Dependency
|
28
|
+
name: rfc2047
|
29
|
+
requirement: !ruby/object:Gem::Requirement
|
30
|
+
requirements:
|
31
|
+
- - "~>"
|
32
|
+
- !ruby/object:Gem::Version
|
33
|
+
version: '0.3'
|
34
|
+
type: :runtime
|
35
|
+
prerelease: false
|
36
|
+
version_requirements: !ruby/object:Gem::Requirement
|
37
|
+
requirements:
|
38
|
+
- - "~>"
|
39
|
+
- !ruby/object:Gem::Version
|
40
|
+
version: '0.3'
|
41
|
+
- !ruby/object:Gem::Dependency
|
42
|
+
name: logstash-devutils
|
43
|
+
requirement: !ruby/object:Gem::Requirement
|
44
|
+
requirements:
|
45
|
+
- - "~>"
|
46
|
+
- !ruby/object:Gem::Version
|
47
|
+
version: '0'
|
48
|
+
type: :development
|
49
|
+
prerelease: false
|
50
|
+
version_requirements: !ruby/object:Gem::Requirement
|
51
|
+
requirements:
|
52
|
+
- - "~>"
|
53
|
+
- !ruby/object:Gem::Version
|
54
|
+
version: '0'
|
55
|
+
- !ruby/object:Gem::Dependency
|
56
|
+
name: logstash-filter-grok
|
57
|
+
requirement: !ruby/object:Gem::Requirement
|
58
|
+
requirements:
|
59
|
+
- - "~>"
|
60
|
+
- !ruby/object:Gem::Version
|
61
|
+
version: '3.2'
|
62
|
+
type: :development
|
63
|
+
prerelease: false
|
64
|
+
version_requirements: !ruby/object:Gem::Requirement
|
65
|
+
requirements:
|
66
|
+
- - "~>"
|
67
|
+
- !ruby/object:Gem::Version
|
68
|
+
version: '3.2'
|
69
|
+
- !ruby/object:Gem::Dependency
|
70
|
+
name: logstash-patterns-core
|
71
|
+
requirement: !ruby/object:Gem::Requirement
|
72
|
+
requirements:
|
73
|
+
- - "~>"
|
74
|
+
- !ruby/object:Gem::Version
|
75
|
+
version: '4.0'
|
76
|
+
type: :development
|
77
|
+
prerelease: false
|
78
|
+
version_requirements: !ruby/object:Gem::Requirement
|
79
|
+
requirements:
|
80
|
+
- - "~>"
|
81
|
+
- !ruby/object:Gem::Version
|
82
|
+
version: '4.0'
|
83
|
+
description: This gem is a Logstash plugin required to be installed on top of the
|
84
|
+
Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
|
85
|
+
gem is not a stand-alone program
|
86
|
+
email: tomasz.habiger@gmail.com
|
87
|
+
executables: []
|
88
|
+
extensions: []
|
89
|
+
extra_rdoc_files: []
|
90
|
+
files:
|
91
|
+
- Gemfile
|
92
|
+
- LICENSE
|
93
|
+
- NOTICE.TXT
|
94
|
+
- README.md
|
95
|
+
- lib/logstash/filters/rfc2047.rb
|
96
|
+
- logstash-filter-rfc2047.gemspec
|
97
|
+
- spec/filters/rfc2047_spec.rb
|
98
|
+
- spec/patterns/local
|
99
|
+
- spec/spec_helper.rb
|
100
|
+
homepage: ''
|
101
|
+
licenses:
|
102
|
+
- Apache License (2.0)
|
103
|
+
metadata:
|
104
|
+
logstash_plugin: 'true'
|
105
|
+
logstash_group: filter
|
106
|
+
post_install_message:
|
107
|
+
rdoc_options: []
|
108
|
+
require_paths:
|
109
|
+
- lib
|
110
|
+
required_ruby_version: !ruby/object:Gem::Requirement
|
111
|
+
requirements:
|
112
|
+
- - ">="
|
113
|
+
- !ruby/object:Gem::Version
|
114
|
+
version: '0'
|
115
|
+
required_rubygems_version: !ruby/object:Gem::Requirement
|
116
|
+
requirements:
|
117
|
+
- - ">="
|
118
|
+
- !ruby/object:Gem::Version
|
119
|
+
version: '0'
|
120
|
+
requirements: []
|
121
|
+
rubyforge_project:
|
122
|
+
rubygems_version: 2.2.2
|
123
|
+
signing_key:
|
124
|
+
specification_version: 4
|
125
|
+
summary: This plugin decodes the RFC2047 format headers.
|
126
|
+
test_files:
|
127
|
+
- spec/filters/rfc2047_spec.rb
|
128
|
+
- spec/patterns/local
|
129
|
+
- spec/spec_helper.rb
|