logstash-filter-split 3.0.1 → 3.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4398dd4c70214c59c92331220fe5b15f5728e232
-  data.tar.gz: 35a99822b070eba332dd17d89931cf9a1b54f7eb
+  metadata.gz: 0c289e206791d9973f7c598e12d78142a7dae422
+  data.tar.gz: 8cbde317a3f26193de7a38c505a356f691aade5a
 SHA512:
-  metadata.gz: d22fe146281d1ed91fbb1cdff226627a5b499db0a05a24bee70d490f0c892e5cdf1d1b1eeba369f79fc85cd2185f495e8037d91c9d13a8da8af42f83989296e8
-  data.tar.gz: b5e8943c76387bef3cd5f0a51cf2436c03d7e5f549ce1af5fded36a55f537ce3da25abe57ca817e26b7d6af49b3d6465b9b192a68f842edf0eb22f19298bf16b
+  metadata.gz: a26f3dce99502455905ee8a98832f63fd59af391121d10045343b3a21130fa04b8bf78326a13b8f1df6d73d365a6651c2526074a1a623a8432b58c8fcfc70686
+  data.tar.gz: 4e4432deac0dc8732c6934e3b8cf79b650fb9e28417f894a7a68886e907f795d5cd084f687023578920da58eedaffc9f0a277026a45346c29547368dd6699153

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 3.1.1
+  - Relax constraint on logstash-core-plugin-api to >= 1.60 <= 2.99
+
+## 3.1.0
+  - Log and tag attempts to split invalid types instead of crashing logstash
 ## 3.0.1
   - Republish all the gems under jruby.
 ## 3.0.0
@@ -7,7 +12,6 @@
 # 2.0.3
   - New dependency requirements for logstash-core for the 5.0 release
 ## 2.0.0
- - Plugins were updated to follow the new shutdown semantic, this mainly allows Logstash to instruct input plugins to terminate gracefully, 
+ - Plugins were updated to follow the new shutdown semantic, this mainly allows Logstash to instruct input plugins to terminate gracefully,
    instead of using Thread.raise on the plugins' threads. Ref: https://github.com/elastic/logstash/pull/3895
  - Dependency on logstash-core update to 2.0
-

data/lib/logstash/filters/split.rb

@@ -11,17 +11,47 @@ require "logstash/namespace"
 # the whole output of a command and splitting that output by newline -
 # making each line an event.
 #
+# Split filter can also be used to split array fields in events into individual events.
+# A very common pattern in JSON & XML is to make use of lists to group data together.
+#
+# For example, a json structure like this:
+#
+# [source,js]
+# ----------------------------------
+# { field1: ...,
+#  results: [
+#    { result ... },
+#    { result ... },
+#    { result ... },
+#    ...
+# ] }
+# ----------------------------------
+#
+# The split filter can be used on the above data to create separate events for each value of `results` field
+#
+# [source,js]
+# ----------------------------------
+# filter {
+#  split {
+#    field => "results"
+#  }
+# }
+# ----------------------------------
+#
 # The end result of each split is a complete copy of the event
 # with only the current split section of the given field changed.
 class LogStash::Filters::Split < LogStash::Filters::Base
+  PARSE_FAILURE_TAG = '_split_type_failure'.freeze
 
   config_name "split"
 
   # The string to split on. This is usually a line terminator, but can be any
-  # string.
+  # string. If you are splitting a JSON array into multiple events, you can ignore this field.
   config :terminator, :validate => :string, :default => "\n"
 
-  # The field whose value is to be split by the terminator.
+  # The field which value is split by the terminator.  
+  # Can be a multiline message or the ID of an array.  
+  # Nested arrays are referenced like: "[object_id][array_id]"
   config :field, :validate => :string, :default => "message"
 
   # The field within the new event which the value is split into.
@@ -46,7 +76,9 @@ class LogStash::Filters::Split < LogStash::Filters::Base
       # splits.
       splits = original_value.split(@terminator, -1)
     else
-      raise LogStash::ConfigurationError, "Only String and Array types are splittable. field:#{@field} is of type = #{original_value.class}"
+      logger.warn("Only String and Array types are splittable. field:#{@field} is of type = #{original_value.class}")
+      event.tag(PARSE_FAILURE_TAG)
+      return
     end
 
     # Skip filtering if splitting this event resulted in only one thing found.

data/logstash-filter-split.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-split'
-  s.version         = '3.0.1'
+  s.version         = '3.1.1'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "The split filter is for splitting multiline messages into separate events."
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
@@ -20,7 +20,7 @@ Gem::Specification.new do |s|
   s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
 
   # Gem dependencies
-  s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
+  s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
 
   s.add_development_dependency 'logstash-devutils'
 end

data/spec/filters/split_spec.rb

@@ -101,10 +101,21 @@ describe LogStash::Filters::Split do
   end
 
   context "when invalid type is passed" do
-    it "should raise exception" do
-      filter = LogStash::Filters::Split.new({"field" => "field"})
-      event = LogStash::Event.new("field" => 10)
-      expect {filter.filter(event)}.to raise_error
+    let(:filter) { LogStash::Filters::Split.new({"field" => "field"}) }
+    let(:logger) { filter.logger }
+    let(:event) { event = LogStash::Event.new("field" => 10) }
+
+    before do
+      allow(filter.logger).to receive(:warn).with(anything)
+      filter.filter(event)
+    end
+    
+    it "should log an error" do
+      expect(filter.logger).to have_received(:warn).with(/Only String and Array types are splittable/)
+    end
+
+    it "should add a '_splitparsefailure' tag" do
+      expect(event.get("tags")).to include(LogStash::Filters::Split::PARSE_FAILURE_TAG)
     end
   end
 end

metadata

@@ -1,29 +1,35 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-split
 version: !ruby/object:Gem::Version
-  version: 3.0.1
+  version: 3.1.1
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2016-05-09 00:00:00.000000000 Z
+date: 2016-07-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.60'
+    - - "<="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.99'
   name: logstash-core-plugin-api
   prerelease: false
   type: :runtime
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.60'
+    - - "<="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.99'
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
     requirements:
@@ -75,7 +81,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project:
-rubygems_version: 2.4.8
+rubygems_version: 2.6.3
 signing_key:
 specification_version: 4
 summary: The split filter is for splitting multiline messages into separate events.