logstash-filter-syslog_pri 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5a5a19ac8bab6399099fa54f6c0cbaf8b8b77e9e
-  data.tar.gz: c5e9fe5419b777eaa415f56d0c3ff7196d8100a9
+  metadata.gz: df705202b239ed3d14afc81e8072e643fbcef41f
+  data.tar.gz: 7f869def7afa8d180a7202e7d49cb3fdc4ef5582
 SHA512:
-  metadata.gz: abb120253770aef3a112dce6eaa9f1d5113ab08b28d86d3205a52d58287084f807e911bce8a2d3904c6c09f2584b32d2a4ec058050b70a0651cd39e94dea7033
-  data.tar.gz: 58cafe0d0f826d077fc2e9dacfbc7884a0895b0108359cdaa84cf161bfb615cb23d3c8d83d25aedc53974bfb9483e4a58a5241d4e1182026350989118c70e23b
+  metadata.gz: 6c9ffb7129e032df6159b67f49b06048e830470f27cac4dc05c7b2353ab5187b0180395da99678ff91c959530d3a41a2bd5728e81b91d58e798c1354523cd3b4
+  data.tar.gz: 2926151113286a791c6244d05d89388ab3ee530e649750068a1a4ed14e1aa92d7a1b03f1dbcdb6aa3f2874cf4d4b3249dc66f50d7412ee910b2dec5da057a71c

data/README.md

@@ -1,15 +1,15 @@
 # Logstash Plugin
 
-This is a plugin for [Logstash](https://github.com/elasticsearch/logstash).
+This is a plugin for [Logstash](https://github.com/elastic/logstash).
 
 It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.
 
 ## Documentation
 
-Logstash provides infrastructure to automatically generate documentation for this plugin. We use the asciidoc format to write documentation so any comments in the source code will be first converted into asciidoc and then into html. All plugin documentation are placed under one [central location](http://www.elasticsearch.org/guide/en/logstash/current/).
+Logstash provides infrastructure to automatically generate documentation for this plugin. We use the asciidoc format to write documentation so any comments in the source code will be first converted into asciidoc and then into html. All plugin documentation are placed under one [central location](http://www.elastic.co/guide/en/logstash/current/).
 
 - For formatting code or config example, you can use the asciidoc `[source,ruby]` directive
-- For more asciidoc formatting tips, see the excellent reference here https://github.com/elasticsearch/docs#asciidoc-guide
+- For more asciidoc formatting tips, see the excellent reference here https://github.com/elastic/docs#asciidoc-guide
 
 ## Need Help?
 
@@ -83,4 +83,4 @@ Programming is not a required skill. Whatever you've seen about open source and
 
 It is more important to the community that you are able to contribute.
 
-For more information about contributing, see the [CONTRIBUTING](https://github.com/elasticsearch/logstash/blob/master/CONTRIBUTING.md) file.
+For more information about contributing, see the [CONTRIBUTING](https://github.com/elastic/logstash/blob/master/CONTRIBUTING.md) file.

data/logstash-filter-syslog_pri.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-syslog_pri'
-  s.version         = '1.0.0'
+  s.version         = '1.0.1'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Filter plugin for logstash to parse the PRI field from the front of a Syslog (RFC3164) message"
   s.description     = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
@@ -11,7 +11,7 @@ Gem::Specification.new do |s|
   s.require_paths = ["lib"]
 
   # Files
-  s.files = `git ls-files`.split($\)
+  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
 
   # Tests
   s.test_files = s.files.grep(%r{^(test|spec|features)/})
@@ -21,7 +21,6 @@ Gem::Specification.new do |s|
 
   # Gem dependencies
   s.add_runtime_dependency "logstash-core", '>= 1.4.0', '< 2.0.0'
-
   s.add_development_dependency 'logstash-devutils'
-end
 
+end

data/spec/filters/syslog_pri_spec.rb

@@ -1,5 +1,113 @@
-require "logstash/devutils/rspec/spec_helper"
-require 'logstash/filters/syslog_pri'
+# encoding: utf-8
+require_relative "../spec_helper"
+require "logstash/plugin"
+require "logstash/event"
 
 describe LogStash::Filters::Syslog_pri do
+
+  subject          { LogStash::Filters::Syslog_pri.new( "syslog_pri_field_name" => "syslog_pri" ) }
+  let(:properties) { {:name => "foo" } }
+  let(:event)      { LogStash::Event.new(properties) }
+
+  it "should register without errors" do
+    plugin = LogStash::Plugin.lookup("filter", "syslog_pri").new( "facility_labels" => ["kernel"] )
+    expect { plugin.register }.to_not raise_error
+  end
+
+  describe "defaults" do
+
+    subject          { LogStash::Filters::Syslog_pri.new( "syslog_pri_field_name" => "my_syslog_pri" ) }
+
+    let(:properties) { { "syslog_pri" => 1 } }
+    let(:event)      { LogStash::Event.new(properties) }
+
+    before(:each) do
+      subject.register
+    end
+
+    it "default syslog_facility is user-level" do
+      subject.filter(event)
+      expect(event["syslog_facility"]).to eq("user-level")
+    end
+
+    it "default syslog severity is notice" do
+      subject.filter(event)
+      expect(event["syslog_severity"]).to eq("notice")
+    end
+
+    it "default severity to be 5, out of priority default 13" do
+      subject.filter(event)
+      expect(event["syslog_severity_code"]).to eq(5)
+    end
+
+  end
+
+  describe "filtering" do
+
+    let(:properties) { { "syslog_pri" => syslog_pri } }
+    let(:event)      { LogStash::Event.new(properties) }
+
+    before(:each) do
+      subject.register
+    end
+
+    context "when critical messages arrive" do
+      let(:syslog_pri) { 34 }
+
+      it "syslog severity is critical" do
+        subject.filter(event)
+        expect(event["syslog_severity"]).to eq("critical")
+      end
+
+      it "default syslog_facility is user-level" do
+        subject.filter(event)
+        expect(event["syslog_facility"]).to eq("security/authorization")
+      end
+
+    end
+
+    context "when notice local messages arrive" do
+      let(:syslog_pri) { 165 }
+
+      it "syslog severity is notice" do
+        subject.filter(event)
+        expect(event["syslog_severity"]).to eq("notice")
+      end
+
+      it "default syslog_facility is user-level" do
+        subject.filter(event)
+        expect(event["syslog_facility"]).to eq("local4")
+      end
+    end
+
+    context "when a debug messages arrive" do
+      let(:syslog_pri) { 191 }
+
+      it "syslog severity is notice" do
+        subject.filter(event)
+        expect(event["syslog_severity"]).to eq("debug")
+      end
+
+      it "default syslog_facility is user-level" do
+        subject.filter(event)
+        expect(event["syslog_facility"]).to eq("local7")
+      end
+    end
+
+    context "when an alert messages arrive" do
+      let(:syslog_pri) { 137 }
+
+      it "syslog severity is notice" do
+        subject.filter(event)
+        expect(event["syslog_severity"]).to eq("alert")
+      end
+
+      it "default syslog_facility is user-level" do
+        subject.filter(event)
+        expect(event["syslog_facility"]).to eq("local1")
+      end
+    end
+
+  end
+
 end

data/spec/spec_helper.rb

@@ -0,0 +1,3 @@
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"
+require 'logstash/filters/syslog_pri'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-syslog_pri
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2015-06-24 00:00:00.000000000 Z
+date: 2015-09-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core
@@ -50,17 +50,16 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- .gitignore
+- lib/logstash/filters/syslog_pri.rb
+- spec/spec_helper.rb
+- spec/filters/syslog_pri_spec.rb
+- logstash-filter-syslog_pri.gemspec
 - CHANGELOG.md
+- README.md
 - CONTRIBUTORS
 - Gemfile
 - LICENSE
 - NOTICE.TXT
-- README.md
-- Rakefile
-- lib/logstash/filters/syslog_pri.rb
-- logstash-filter-syslog_pri.gemspec
-- spec/filters/syslog_pri_spec.rb
 homepage: http://www.elastic.co/guide/en/logstash/current/index.html
 licenses:
 - Apache License (2.0)
@@ -83,9 +82,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project:
-rubygems_version: 2.2.2
+rubygems_version: 2.1.9
 signing_key:
 specification_version: 4
 summary: Filter plugin for logstash to parse the PRI field from the front of a Syslog (RFC3164) message
 test_files:
+- spec/spec_helper.rb
 - spec/filters/syslog_pri_spec.rb

data/.gitignore

@@ -1,4 +0,0 @@
-*.gem
-Gemfile.lock
-.bundle
-vendor

data/Rakefile

@@ -1,7 +0,0 @@
-@files=[]
-
-task :default do
-  system("rake -T")
-end
-
-require "logstash/devutils/rake"