logstash-filter-transaction_time 1.0.1 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 791175d5aab745baae8183abe08c091593f0d0ca
-  data.tar.gz: d6d2326111fb55b7b36816dbc068b3f63f8a58c3
+  metadata.gz: edc1cb278d1570f38410dfb0adcbc6cb916051b8
+  data.tar.gz: e7af3ddd9246545057682d1f20570fc392f361fc
 SHA512:
-  metadata.gz: 3c6ec8cda7e6da7c3dd9b32c0a347a5bfd811d4ecf182341b8dd054bf3b94bcaa8b40c76ef3ad5447dcb073a83ccfaf51102c865a08d8f72182343740508e801
-  data.tar.gz: 9733638d214930bebae4a08f0aa22046a32bed7f12394df2ff6f7446e76004684d6e65a9bb2d44636b46c14427ac68ca21d792fcbd929fac1f528e1207710aa2
+  metadata.gz: 6ae4104911a6088a0708b5d8f0135af8e28ddf7e1c96b50e30b6e7c1ee8538bf48a1b3f2921e022ff53af1e9f5433c9bcdefaca3bff1ca9735d602121b83200a
+  data.tar.gz: aef8f360cbce787e8482f2e1f24be6fa73e37503335837323f7876aa1d1da3790f28e6a8557f8159e4e1bcf0b6c930480164b4a5f03a7c130cc3b507b7c23b00

data/lib/logstash/filters/transaction_time.rb

@@ -56,8 +56,8 @@ require "logstash/namespace"
 #         }
 #       }
 #       transaction_time {
-#         uid_field => "Transaction-unique field"
-#         filter_tag => "transaction tag"
+#         uid_field => "UID"
+#         filter_tag => "Transaction"
 #       }
 #     }
 #
@@ -65,6 +65,8 @@ require "logstash/namespace"
 # is added for a specific set of messages. 
 # This tag is then used in the transaction_time as filter_tag. 
 # Only the messages with this tag will be evaluated.
+# Note: Do not use reserved name "TransactionTime" 
+#       which is added to all events created by this plugin
 #
 # The attach_event parameter can be used to append information from one of the events to the
 # new transaction_time event. The default is to not attach anything. 
@@ -89,6 +91,7 @@ class LogStash::Filters::TransactionTime < LogStash::Filters::Base
   # Override the new events timestamp with the oldest or newest timestamp or keep the new one (set when logstash has processed the event)
   config :replace_timestamp, :validate => ['keep', 'oldest', 'newest'], :default => 'keep'
   # Tag used to identify transactional events. If set, only events tagged with the specified tag attached will be concidered transactions and be processed by the plugin
+  # Do not use reserved tag name "TransactionTime"
   config :filter_tag, :validate => :string
   # Whether or not to attach one or none of the events in a transaction to the output event. 
   # Defaults to 'none' - which reduces memory footprint by not adding the event to the transactionlist.
@@ -118,10 +121,15 @@ class LogStash::Filters::TransactionTime < LogStash::Filters::Base
 
     @logger.debug("Received UID", uid: uid)
 
-    if (@filter_tag.nil? || (!event.get("tags").nil? && event.get("tags").include?(@filter_tag)))
+    #Dont use filter-plugin on events created by this filter-plugin
+    #Dont use filter on anything else but events with the filter_tag if specified
+    if (!uid.nil? && (event.get("tags").nil? || !event.get("tags").include?(TRANSACTION_TIME_TAG)) &&
+      (@filter_tag.nil? || (!event.get("tags").nil? && event.get("tags").include?(@filter_tag))))
+      filter_matched(event) 
       @mutex.synchronize do
         if(!@transactions.has_key?(uid))
           @transactions[uid] = LogStash::Filters::TransactionTime::Transaction.new(event, uid, @storeEvent)
+
         else #End of transaction
           @transactions[uid].addSecond(event,@storeEvent)
           transaction_event = new_transactiontime_event(@transactions[uid])
@@ -132,10 +140,6 @@ class LogStash::Filters::TransactionTime < LogStash::Filters::Base
       end
     end
 
-    event.set("uid_field", @uid_field)
-
-    # filter_matched should go in the last line of our successful code
-    filter_matched(event)
   end # def filter
 
 
@@ -173,33 +177,36 @@ class LogStash::Filters::TransactionTime < LogStash::Filters::Base
   end
 
   def new_transactiontime_event(transaction)
+
+
       case @attach_event
       when 'oldest'
-        event = transaction.getOldestEvent()
+        transaction_event = transaction.getOldestEvent()
       when 'first'
-        event = transaction.firstEvent
+        transaction_event = transaction.firstEvent
       when 'newest'
-        event = transaction.getNewestEvent()
+        transaction_event = transaction.getNewestEvent()
       when 'last'
-        event = transaction.lastEvent
-      else 
-        event = LogStash::Event.new
+        transaction_event = transaction.lastEvent
+      else
+        transaction_event = LogStash::Event.new
       end
-      event.set(HOST_FIELD, Socket.gethostname)
+      transaction_event.set(HOST_FIELD, Socket.gethostname)
+
 
-      event.tag(TRANSACTION_TIME_TAG)
-      event.set(TRANSACTION_TIME_FIELD, transaction.diff)
-      event.set(TRANSACTION_UID_FIELD, transaction.uid)
-      event.set(TIMESTAMP_START_FIELD, transaction.getOldestTimestamp())
+      transaction_event.tag(TRANSACTION_TIME_TAG)
+      transaction_event.set(TRANSACTION_TIME_FIELD, transaction.diff)
+      transaction_event.set(TRANSACTION_UID_FIELD, transaction.uid)
+      transaction_event.set(TIMESTAMP_START_FIELD, transaction.getOldestTimestamp())
 
       if(@replace_timestamp.eql?'oldest')
-        event.set("@timestamp", transaction.getOldestTimestamp())
+        transaction_event.set("@timestamp", transaction.getOldestTimestamp())
       elsif (@replace_timestamp.eql?'newest')
-        event.set("@timestamp", transaction.getNewestTimestamp())
+        transaction_event.set("@timestamp", transaction.getNewestTimestamp())
       end
           
 
-      return event
+      return transaction_event
   end
 
 

data/logstash-filter-transaction_time.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name          = 'logstash-filter-transaction_time'
-  s.version       = '1.0.1'
+  s.version       = '1.0.2'
   s.licenses      = ['Apache-2.0','Apache License (2.0)']
   s.summary       = 'Writes the time difference between two events in a transaction to a new event'
   s.description   = 'This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program. Source-code and documentation available at github: https://github.com/AddinITAB/logstash-filter-transaction_time'

data/spec/filters/transaction_time_spec.rb

@@ -24,7 +24,7 @@ describe LogStash::Filters::TransactionTime do
       expect(subject.get('timestamp_tag')).to eq('testing')
     end
 
-    sample("uid_field" => "some text") do
+    sample("uid_field" => "uid") do
       expect(subject).to include("uid_field")
       expect(subject.get('uid_field')).to eq('uid')
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-transaction_time
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.0.2
 platform: ruby
 authors:
 - Tommy Welleby
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-04-26 00:00:00.000000000 Z
+date: 2018-04-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement