logstash-filter-varnishlog 0.1.6 → 0.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 132dc667645e4c0ed4ad0923d2e3c663e0b43c1e
-  data.tar.gz: d89076af90343002b99b42d7326ffe5e4be15647
+  metadata.gz: b5bad4a2635a7e8d23f99156c2bb9d7dda5ab37b
+  data.tar.gz: 3336e14b86616bf2ea870769eecc06851f26ed4f
 SHA512:
-  metadata.gz: 62741d02b6fcc571b679fd0affb71806c2e5dffea3a2f29c795ea97ec68658089763c676426a96391ec2c4e1e62e34df25c9bcd2863b55619822aa78b8f34b40
-  data.tar.gz: cff06e7c4f7b91c6a95b2e4dd8398a5d38b2d5c7f17b72313198f5ca19b3dfd9c73ed77f915ec6cb6b95d3560645f6652b9de7e991973b8bca7f2e76abdc5235
+  metadata.gz: 92d81615cc6f94db12c8dbf769922a0b9ab6f21c7d4f7d29169ea3395c6151caf6bbfdb921c819541050da4504bcb4675f7240c9eeb175fc319c5f490d1b0baf
+  data.tar.gz: 685985a711e67a5d8e1686493731b26e964f939840110d168cebbc620c6609dc8e2b278d4ab2879df9530bbf95e67a86664254f3984c3a1cd3292e983651f694

data/CHANGELOG.md

@@ -1,3 +1,5 @@
+## 0.1.7
+  - Refactor regex parser
 ## 0.1.6
   - Make Blacklist Case-Insentive
   - Add normalize_fieldnames option 

data/lib/logstash/filters/varnishlog.rb

@@ -39,6 +39,9 @@ class LogStash::Filters::Varnishlog < LogStash::Filters::Base
   public
   def filter(event)
     items = event.get("[message]").split("\n")
+    if request=/\*+\s+<<\s+(?<type>\w+)\s+>>\s+/.match(items[0])
+      event.set("type", request['type'].downcase)
+    end
     ##Remove Blacklisted items from items hash
     items = items.grepv(blacklist_sections.join("|")) if blacklist_sections.any?
     ##
@@ -50,6 +53,14 @@ class LogStash::Filters::Varnishlog < LogStash::Filters::Base
         event.set(normalize_fields("timestamp_" + match['step'] ), match['time_a'])
       end
     end
+
+    ##Acct
+    account = items.grep(/(Be|Req)Acct/)
+    account.each do |acct|
+      if acct_match = /-\s+(Be|Req)Acct\s+(?<size_a>\d)\s+(?<size_b>\d)\s+(?<size_c>\d)\s+(?<size_d>\d)\s+(?<size_e>\d)\s+(?<size_f>\d)\s+/.match(acct)
+        event.set("bytes", acct_match['size_e'])
+      end
+    end
     ## VCL Log
     vcl_log = items.grep(/VCL_Log/)
     log_lines = []
@@ -64,57 +75,45 @@ class LogStash::Filters::Varnishlog < LogStash::Filters::Base
 
     # Requests
     ## Request headers.
-    request_headers = items.grep(/ReqHeader/)
+    request_headers = items.grep(/(Be)?([rR]eq|[rR]esp)Header/)
     request_headers.each do |header|
-      if match = /-+\s+ReqHeader\s+(?<header_name>.*?): (?<header_value>.*)/.match(header)
+      if match = /-+\s+(Be)?([rR]eq|[rR]esp)Header\s+(?<header_name>.*?): (?<header_value>.*)/.match(header)
         event.set(normalize_fields(match['header_name']), match['header_value'])
       end
     end
     ## Match ReqMethod.
-    if method_match = /-+\s+ReqMethod\s+(?<method>.*)/.match(items.grep(/ReqMethod/)[0])
-      event.set("ReqMethod", method_match['method'])
+    if method_match = /-+\s+(Be)?([rR]eq|[rR]esp)Method\s+(?<method>.*)/.match(items.grep(/(Be)?([rR]eq|[rR]esp)Method/)[0])
+      event.set("http_method", method_match['method'])
     end
     ## Match ReqURL.
-    if url_match = /-+\s+ReqURL\s+(?<url>\/.*)/.match(items.grep(/ReqURL/)[0])
-      event.set("ReqUrl", url_match['url'])
+    if url_match = /-+\s+(Be)?([rR]eq|[rR]esp)URL\s+(?<url>\/.*)/.match(items.grep(/(Be)?([rR]eq|[rR]esp)URL/)[0])
+      event.set("url", url_match['url'])
     end
     ## Match ReqProtocol.
-    if protocol_match = /-+\s+ReqProtocol\s+(?<protocol>.*)/.match(items.grep(/ReqProtocol/)[0])
-      event.set("ReqProtocol", protocol_match['protocol'])
+    if protocol_match = /-+\s+(Be)?([rR]eq|[rR]esp)Protocol\s+(?<protocol>.*)/.match(items.grep(/(Be)?([rR]eq|[rR]esp)Protocol/)[0])
+      event.set("protocol", protocol_match['protocol'])
     end
 
-    # Response
-    ## Response headers.
-    response_headers = items.grep(/RespHeader/)
-    response_headers.each do |header|
-      if match = /-+\s+RespHeader\s+(?<header_name>.*?): (?<header_value>.*)/.match(header)
-        event.set(normalize_fields(match['header_name']), match['header_value'])
-      end
-    end
-    ## Match RespProtocol
-    if protocol_match = /-+\s+RespProtocol\s+(?<protocol>.*)/.match(items.grep(/RespProtocol/)[0])
-      event.set("RespProtocol", protocol_match['protocol'])
-    end
     ## Match RespStatus
-    status_match = items.grep(/RespStatus/)
+    status_match = items.grep(/(Be)?([rR]eq|[rR]esp)Status/)
     states = []
     status_match.each_with_index do |status, index|
-      if match = /-+\s+RespStatus\s+(?<status>.*)/.match(status)
+      if match = /-+\s+(Be)?([rR]eq|[rR]esp)Status\s+(?<status>.*)/.match(status)
         states.push(match['status'].to_i)
       end
       if index == status_match.size - 1
-        event.set("RespStatus", states)
+        event.set("http-rc", states)
       end
     end
     ## Match RespReason
-    response_reason = items.grep(/RespReason/)
+    response_reason = items.grep(/(Be)?([rR]eq|[rR]esp)Reason/)
     reasons = []
     response_reason.each_with_index do |reason, index|
-      if match = /-+\s+RespReason\s+(?<reason>.*)/.match(reason)
+      if match = /-+\s+(Be)?([rR]eq|[rR]esp)Reason\s+(?<reason>.*)/.match(reason)
         reasons.push(match['reason'])
       end
       if index == response_reason.size - 1
-        event.set("RespReason", reasons)
+        event.set("reason", reasons)
       end
     end
 

data/logstash-filter-varnishlog.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name          = 'logstash-filter-varnishlog'
-  s.version       = '0.1.6'
+  s.version       = '0.1.7'
   s.licenses      = ['Apache License (2.0)']
   s.summary       = 'A logstash plugin reading varnishlog output'
   s.description   = 'logstash filter plugin reading varnishlog grouped by id'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-varnishlog
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.1.7
 platform: ruby
 authors:
 - Christian Herweg
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-03-20 00:00:00.000000000 Z
+date: 2018-04-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement