logstash-input-beats 0.9.2 → 0.9.3

data/vendor/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/event.rb

@@ -1,275 +0,0 @@
-# encoding: utf-8
-require "time"
-require "date"
-require "cabin"
-require "logstash/namespace"
-require "logstash/util/accessors"
-require "logstash/timestamp"
-require "logstash/json"
-require "logstash/string_interpolation"
-
-# transcient pipeline events for normal in-flow signaling as opposed to
-# flow altering exceptions. for now having base classes is adequate and
-# in the future it might be necessary to refactor using like a BaseEvent
-# class to have a common interface for all pileline events to support
-# eventual queueing persistence for example, TBD.
-class LogStash::ShutdownEvent; end
-class LogStash::FlushEvent; end
-
-module LogStash
-  FLUSH = LogStash::FlushEvent.new
-
-  # LogStash::SHUTDOWN is used by plugins
-  SHUTDOWN = LogStash::ShutdownEvent.new
-end
-
-# the logstash event object.
-#
-# An event is simply a tuple of (timestamp, data).
-# The 'timestamp' is an ISO8601 timestamp. Data is anything - any message,
-# context, references, etc that are relevant to this event.
-#
-# Internally, this is represented as a hash with only two guaranteed fields.
-#
-# * "@timestamp" - an ISO8601 timestamp representing the time the event
-#   occurred at.
-# * "@version" - the version of the schema. Currently "1"
-#
-# They are prefixed with an "@" symbol to avoid clashing with your
-# own custom fields.
-#
-# When serialized, this is represented in JSON. For example:
-#
-#     {
-#       "@timestamp": "2013-02-09T20:39:26.234Z",
-#       "@version": "1",
-#       message: "hello world"
-#     }
-class LogStash::Event
-  class DeprecatedMethod < StandardError; end
-
-  CHAR_PLUS = "+"
-  TIMESTAMP = "@timestamp"
-  VERSION = "@version"
-  VERSION_ONE = "1"
-  TIMESTAMP_FAILURE_TAG = "_timestampparsefailure"
-  TIMESTAMP_FAILURE_FIELD = "_@timestamp"
-
-  METADATA = "@metadata".freeze
-  METADATA_BRACKETS = "[#{METADATA}]".freeze
-
-  # Floats outside of these upper and lower bounds are forcibly converted
-  # to scientific notation by Float#to_s
-  MIN_FLOAT_BEFORE_SCI_NOT = 0.0001
-  MAX_FLOAT_BEFORE_SCI_NOT = 1000000000000000.0
-
-  LOGGER = Cabin::Channel.get(LogStash)
-
-  public
-  def initialize(data = {})
-    @cancelled = false
-    @data = data
-    @accessors = LogStash::Util::Accessors.new(data)
-    @data[VERSION] ||= VERSION_ONE
-    ts = @data[TIMESTAMP]
-    @data[TIMESTAMP] = ts ? init_timestamp(ts) : LogStash::Timestamp.now
-
-    @metadata = @data.delete(METADATA) || {}
-    @metadata_accessors = LogStash::Util::Accessors.new(@metadata)
-  end # def initialize
-
-  public
-  def cancel
-    @cancelled = true
-  end # def cancel
-
-  public
-  def uncancel
-    @cancelled = false
-  end # def uncancel
-
-  public
-  def cancelled?
-    return @cancelled
-  end # def cancelled?
-
-  # Create a deep-ish copy of this event.
-  public
-  def clone
-    copy = {}
-    @data.each do |k,v|
-      # TODO(sissel): Recurse if this is a hash/array?
-      copy[k] = begin v.clone rescue v end
-    end
-    return self.class.new(copy)
-  end # def clone
-
-  public
-  def to_s
-    self.sprintf("#{timestamp.to_iso8601} %{host} %{message}")
-  end # def to_s
-
-  public
-  def timestamp; return @data[TIMESTAMP]; end # def timestamp
-  def timestamp=(val); return @data[TIMESTAMP] = val; end # def timestamp=
-
-  def unix_timestamp
-    raise DeprecatedMethod
-  end # def unix_timestamp
-
-  def ruby_timestamp
-    raise DeprecatedMethod
-  end # def unix_timestamp
-
-  public
-  def [](fieldref)
-    if fieldref.start_with?(METADATA_BRACKETS)
-      @metadata_accessors.get(fieldref[METADATA_BRACKETS.length .. -1])
-    elsif fieldref == METADATA
-      @metadata
-    else
-      @accessors.get(fieldref)
-    end
-  end # def []
-
-  public
-  def []=(fieldref, value)
-    if fieldref == TIMESTAMP && !value.is_a?(LogStash::Timestamp)
-      raise TypeError, "The field '@timestamp' must be a (LogStash::Timestamp, not a #{value.class} (#{value})"
-    end
-    if fieldref.start_with?(METADATA_BRACKETS)
-      @metadata_accessors.set(fieldref[METADATA_BRACKETS.length .. -1], value)
-    elsif fieldref == METADATA
-      @metadata = value
-      @metadata_accessors = LogStash::Util::Accessors.new(@metadata)
-    else
-      @accessors.set(fieldref, value)
-    end
-  end # def []=
-
-  public
-  def fields
-    raise DeprecatedMethod
-  end
-
-  public
-  def to_json(*args)
-    # ignore arguments to respect accepted to_json method signature
-    LogStash::Json.dump(@data)
-  end # def to_json
-
-  public
-  def to_hash
-    @data
-  end # def to_hash
-
-  public
-  def overwrite(event)
-    # pickup new event @data and also pickup @accessors
-    # otherwise it will be pointing on previous data
-    @data = event.instance_variable_get(:@data)
-    @accessors = event.instance_variable_get(:@accessors)
-
-    #convert timestamp if it is a String
-    if @data[TIMESTAMP].is_a?(String)
-      @data[TIMESTAMP] = LogStash::Timestamp.parse_iso8601(@data[TIMESTAMP])
-    end
-  end
-
-  public
-  def include?(fieldref)
-    if fieldref.start_with?(METADATA_BRACKETS)
-      @metadata_accessors.include?(fieldref[METADATA_BRACKETS.length .. -1])
-    elsif fieldref == METADATA
-      true
-    else
-      @accessors.include?(fieldref)
-    end
-  end # def include?
-
-  # Append an event to this one.
-  public
-  def append(event)
-    # non-destructively merge that event with ourselves.
-
-    # no need to reset @accessors here because merging will not disrupt any existing field paths
-    # and if new ones are created they will be picked up.
-    LogStash::Util.hash_merge(@data, event.to_hash)
-  end # append
-
-  # Remove a field or field reference. Returns the value of that field when
-  # deleted
-  public
-  def remove(fieldref)
-    @accessors.del(fieldref)
-  end # def remove
-
-  # sprintf. This could use a better method name.
-  # The idea is to take an event and convert it to a string based on
-  # any format values, delimited by %{foo} where 'foo' is a field or
-  # metadata member.
-  #
-  # For example, if the event has type == "foo" and host == "bar"
-  # then this string:
-  #   "type is %{type} and source is %{host}"
-  # will return
-  #   "type is foo and source is bar"
-  #
-  # If a %{name} value is an array, then we will join by ','
-  # If a %{name} value does not exist, then no substitution occurs.
-  public
-  def sprintf(format)
-    LogStash::StringInterpolation.evaluate(self, format)
-  end
-
-  def tag(value)
-    # Generalize this method for more usability
-    self["tags"] ||= []
-    self["tags"] << value unless self["tags"].include?(value)
-  end
-
-  private
-
-  def init_timestamp(o)
-    begin
-      timestamp = LogStash::Timestamp.coerce(o)
-      return timestamp if timestamp
-
-      LOGGER.warn("Unrecognized #{TIMESTAMP} value, setting current time to #{TIMESTAMP}, original in #{TIMESTAMP_FAILURE_FIELD}field", :value => o.inspect)
-    rescue LogStash::TimestampParserError => e
-      LOGGER.warn("Error parsing #{TIMESTAMP} string, setting current time to #{TIMESTAMP}, original in #{TIMESTAMP_FAILURE_FIELD} field", :value => o.inspect, :exception => e.message)
-    end
-
-    @data["tags"] ||= []
-    @data["tags"] << TIMESTAMP_FAILURE_TAG unless @data["tags"].include?(TIMESTAMP_FAILURE_TAG)
-    @data[TIMESTAMP_FAILURE_FIELD] = o
-
-    LogStash::Timestamp.now
-  end
-
-  public
-  def to_hash_with_metadata
-    @metadata.empty? ? to_hash : to_hash.merge(METADATA => @metadata)
-  end
-
-  public
-  def to_json_with_metadata(*args)
-    # ignore arguments to respect accepted to_json method signature
-    LogStash::Json.dump(to_hash_with_metadata)
-  end # def to_json
-
-  def self.validate_value(value)
-    case value
-    when String
-      raise("expected UTF-8 encoding for value=#{value}, encoding=#{value.encoding.inspect}") unless value.encoding == Encoding::UTF_8
-      raise("invalid UTF-8 encoding for value=#{value}, encoding=#{value.encoding.inspect}") unless value.valid_encoding?
-      value
-    when Array
-      value.each{|v| validate_value(v)} # don't map, return original object
-      value
-    else
-      value
-    end
-  end
-
-end # class LogStash::Event

data/vendor/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/filters/base.rb

@@ -1,241 +0,0 @@
-# encoding: utf-8
-require "logstash/namespace"
-require "logstash/event"
-require "logstash/logging"
-require "logstash/plugin"
-require "logstash/config/mixin"
-require "logstash/util/decorators"
-
-class LogStash::Filters::Base < LogStash::Plugin
-  include LogStash::Config::Mixin
-
-  config_name "filter"
-
-  # Note that all of the specified routing options (`type`,`tags`,`exclude_tags`,`include_fields`,
-  # `exclude_fields`) must be met in order for the event to be handled by the filter.
-
-  # The type to act on. If a type is given, then this filter will only
-  # act on messages with the same type. See any input plugin's `type`
-  # attribute for more.
-  # Optional.
-  config :type, :validate => :string, :default => "", :deprecated => "You can achieve this same behavior with the new conditionals, like: `if [type] == \"sometype\" { %PLUGIN% { ... } }`."
-
-  # Only handle events with all of these tags.
-  # Optional.
-  config :tags, :validate => :array, :default => [], :deprecated => "You can achieve similar behavior with the new conditionals, like: `if \"sometag\" in [tags] { %PLUGIN% { ... } }`"
-
-  # Only handle events without any of these tags.
-  # Optional.
-  config :exclude_tags, :validate => :array, :default => [], :deprecated => "You can achieve similar behavior with the new conditionals, like: `if !(\"sometag\" in [tags]) { %PLUGIN% { ... } }`"
-
-  # If this filter is successful, add arbitrary tags to the event.
-  # Tags can be dynamic and include parts of the event using the `%{field}`
-  # syntax.
-  #
-  # Example:
-  # [source,ruby]
-  #     filter {
-  #       %PLUGIN% {
-  #         add_tag => [ "foo_%{somefield}" ]
-  #       }
-  #     }
-  # [source,ruby]
-  #     # You can also add multiple tags at once:
-  #     filter {
-  #       %PLUGIN% {
-  #         add_tag => [ "foo_%{somefield}", "taggedy_tag"]
-  #       }
-  #     }
-  #
-  # If the event has field `"somefield" == "hello"` this filter, on success,
-  # would add a tag `foo_hello` (and the second example would of course add a `taggedy_tag` tag).
-  config :add_tag, :validate => :array, :default => []
-
-  # If this filter is successful, remove arbitrary tags from the event.
-  # Tags can be dynamic and include parts of the event using the `%{field}`
-  # syntax.
-  #
-  # Example:
-  # [source,ruby]
-  #     filter {
-  #       %PLUGIN% {
-  #         remove_tag => [ "foo_%{somefield}" ]
-  #       }
-  #     }
-  # [source,ruby]
-  #     # You can also remove multiple tags at once:
-  #     filter {
-  #       %PLUGIN% {
-  #         remove_tag => [ "foo_%{somefield}", "sad_unwanted_tag"]
-  #       }
-  #     }
-  #
-  # If the event has field `"somefield" == "hello"` this filter, on success,
-  # would remove the tag `foo_hello` if it is present. The second example
-  # would remove a sad, unwanted tag as well.
-  config :remove_tag, :validate => :array, :default => []
-
-  # If this filter is successful, add any arbitrary fields to this event.
-  # Field names can be dynamic and include parts of the event using the `%{field}`.
-  #
-  # Example:
-  # [source,ruby]
-  #     filter {
-  #       %PLUGIN% {
-  #         add_field => { "foo_%{somefield}" => "Hello world, from %{host}" }
-  #       }
-  #     }
-  # [source,ruby]
-  #     # You can also add multiple fields at once:
-  #     filter {
-  #       %PLUGIN% {
-  #         add_field => {
-  #           "foo_%{somefield}" => "Hello world, from %{host}"
-  #           "new_field" => "new_static_value"
-  #         }
-  #       }
-  #     }
-  #
-  # If the event has field `"somefield" == "hello"` this filter, on success,
-  # would add field `foo_hello` if it is present, with the
-  # value above and the `%{host}` piece replaced with that value from the
-  # event. The second example would also add a hardcoded field.
-  config :add_field, :validate => :hash, :default => {}
-
-  # If this filter is successful, remove arbitrary fields from this event.
-  # Fields names can be dynamic and include parts of the event using the %{field}
-  # Example:
-  # [source,ruby]
-  #     filter {
-  #       %PLUGIN% {
-  #         remove_field => [ "foo_%{somefield}" ]
-  #       }
-  #     }
-  # [source,ruby]
-  #     # You can also remove multiple fields at once:
-  #     filter {
-  #       %PLUGIN% {
-  #         remove_field => [ "foo_%{somefield}", "my_extraneous_field" ]
-  #       }
-  #     }
-  #
-  # If the event has field `"somefield" == "hello"` this filter, on success,
-  # would remove the field with name `foo_hello` if it is present. The second
-  # example would remove an additional, non-dynamic field.
-  config :remove_field, :validate => :array, :default => []
-
-  # Call the filter flush method at regular interval.
-  # Optional.
-  config :periodic_flush, :validate => :boolean, :default => false
-
-  RESERVED = ["type", "tags", "exclude_tags", "include_fields", "exclude_fields", "add_tag", "remove_tag", "add_field", "remove_field", "include_any", "exclude_any"]
-
-  public
-  def initialize(params)
-    super
-    config_init(params)
-    @threadsafe = true
-  end # def initialize
-
-  public
-  def register
-    raise "#{self.class}#register must be overidden"
-  end # def register
-
-  public
-  def filter(event)
-    raise "#{self.class}#filter must be overidden"
-  end # def filter
-
-  # in 1.5.0 multi_filter is meant to be used in the generated filter function in LogStash::Config::AST::Plugin only
-  # and is temporary until we refactor the filter method interface to accept events list and return events list,
-  # just list in multi_filter see https://github.com/elastic/logstash/issues/2872.
-  # refactoring the filter method will mean updating all plugins which we want to avoid doing for 1.5.0.
-  #
-  # @param events [Array<LogStash::Event] list of events to filter
-  # @return [Array<LogStash::Event] filtered events and any new events generated by the filter
-  public
-  def multi_filter(events)
-    result = []
-    events.each do |event|
-      unless event.cancelled?
-        result << event
-        filter(event){|new_event| result << new_event}
-      end
-    end
-    result
-  end
-
-  public
-  def execute(event, &block)
-    filter(event, &block)
-  end # def execute
-
-  public
-  def threadsafe?
-    @threadsafe
-  end
-
-  # a filter instance should call filter_matched from filter if the event
-  # matches the filter's conditions (right type, etc)
-  protected
-  def filter_matched(event)
-    LogStash::Util::Decorators.add_fields(@add_field,event,"filters/#{self.class.name}")
-
-    @remove_field.each do |field|
-      field = event.sprintf(field)
-      @logger.debug? and @logger.debug("filters/#{self.class.name}: removing field",
-                                       :field => field)
-      event.remove(field)
-    end
-
-    LogStash::Util::Decorators.add_tags(@add_tag,event,"filters/#{self.class.name}")
-
-    @remove_tag.each do |tag|
-      break if event["tags"].nil?
-      tag = event.sprintf(tag)
-      @logger.debug? and @logger.debug("filters/#{self.class.name}: removing tag",
-                                       :tag => tag)
-      event["tags"].delete(tag)
-    end
-  end # def filter_matched
-
-  protected
-  def filter?(event)
-    if !@type.empty?
-      if event["type"] != @type
-        @logger.debug? and @logger.debug("filters/#{self.class.name}: Skipping event because type doesn't match",
-                                         :type=> @type, :event => event)
-        return false
-      end
-    end
-
-    if !@tags.empty?
-      # this filter has only works on events with certain tags,
-      # and this event has no tags.
-      return false if !event["tags"]
-
-      # Is @tags a subset of the event's tags? If not, skip it.
-      if (event["tags"] & @tags).size != @tags.size
-        @logger.debug? and @logger.debug("filters/#{self.class.name}: Skipping event because tags don't match",
-                                         :tags => tags, :event => event)
-        return false
-      end
-    end
-
-    if !@exclude_tags.empty? && event["tags"]
-      if (diff_tags = (event["tags"] & @exclude_tags)).size != 0
-        @logger.debug("filters/#{self.class.name}: Skipping event because tags contains excluded tags:",
-                      :diff_tags => diff_tags, :exclude_tags => @exclude_tags, :event => event)
-        return false
-      end
-    end
-
-    return true
-  end
-
-  public
-  def teardown
-    # Nothing to do by default.
-  end
-end # class LogStash::Filters::Base

data/vendor/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/inputs/base.rb

@@ -1,132 +0,0 @@
-# encoding: utf-8
-require "logstash/namespace"
-require "logstash/event"
-require "logstash/plugin"
-require "logstash/logging"
-require "logstash/config/mixin"
-require "logstash/codecs/base"
-require "logstash/util/decorators"
-
-# This is the base class for Logstash inputs.
-class LogStash::Inputs::Base < LogStash::Plugin
-  include LogStash::Config::Mixin
-  config_name "input"
-
-  # Add a `type` field to all events handled by this input.
-  #
-  # Types are used mainly for filter activation.
-  #
-  # The type is stored as part of the event itself, so you can
-  # also use the type to search for it in Kibana.
-  #
-  # If you try to set a type on an event that already has one (for
-  # example when you send an event from a shipper to an indexer) then
-  # a new input will not override the existing type. A type set at
-  # the shipper stays with that event for its life even
-  # when sent to another Logstash server.
-  config :type, :validate => :string
-
-  config :debug, :validate => :boolean, :default => false, :deprecated => "This setting no longer has any effect. In past releases, it existed, but almost no plugin made use of it."
-
-  # The format of input data (plain, json, json_event)
-  config :format, :validate => ["plain", "json", "json_event", "msgpack_event"], :deprecated => "You should use the newer 'codec' setting instead."
-
-  # The codec used for input data. Input codecs are a convenient method for decoding your data before it enters the input, without needing a separate filter in your Logstash pipeline.
-  config :codec, :validate => :codec, :default => "plain"
-
-  # The character encoding used in this input. Examples include `UTF-8`
-  # and `cp1252`
-  #
-  # This setting is useful if your log files are in `Latin-1` (aka `cp1252`)
-  # or in another character set other than `UTF-8`.
-  #
-  # This only affects `plain` format logs since json is `UTF-8` already.
-  config :charset, :deprecated => "Use the codec setting instead. For example: input { %PLUGIN% { codec => plain { charset => \"UTF-8\" } }"
-
-  # If format is `json`, an event `sprintf` string to build what
-  # the display `@message` should be given (defaults to the raw JSON).
-  # `sprintf` format strings look like `%{fieldname}`
-  #
-  # If format is `json_event`, ALL fields except for `@type`
-  # are expected to be present. Not receiving all fields
-  # will cause unexpected results.
-  config :message_format, :validate => :string, :deprecated => true
-
-  # Add any number of arbitrary tags to your event.
-  #
-  # This can help with processing later.
-  config :tags, :validate => :array
-
-  # Add a field to an event
-  config :add_field, :validate => :hash, :default => {}
-
-  attr_accessor :params
-  attr_accessor :threadable
-
-  public
-  def initialize(params={})
-    super
-    @threadable = false
-    config_init(params)
-    @tags ||= []
-
-    if @charset && @codec.class.get_config.include?("charset")
-      # charset is deprecated on inputs, but provide backwards compatibility
-      # by copying the charset setting into the codec.
-
-      @logger.info("Copying input's charset setting into codec", :input => self, :codec => @codec)
-      charset = @charset
-      @codec.instance_eval { @charset = charset }
-    end
-
-    # Backwards compat for the 'format' setting
-    case @format
-      when "plain"; # do nothing
-      when "json"
-        @codec = LogStash::Plugin.lookup("codec", "json").new
-      when "json_event"
-        @codec = LogStash::Plugin.lookup("codec", "oldlogstashjson").new
-    end
-
-  end # def initialize
-
-  public
-  def register
-    raise "#{self.class}#register must be overidden"
-  end # def register
-
-  public
-  def tag(newtag)
-    @tags << newtag
-  end # def tag
-
-  protected
-  def to_event(raw, source)
-    raise LogStash::ThisMethodWasRemoved("LogStash::Inputs::Base#to_event - you should use codecs now instead of to_event. Not sure what this means? Get help on https://discuss.elastic.co/c/logstash")
-  end # def to_event
-
-  protected
-  def decorate(event)
-    # Only set 'type' if not already set. This is backwards-compatible behavior
-    event["type"] = @type if @type && !event.include?("type")
-
-    LogStash::Util::Decorators.add_fields(@add_field,event,"inputs/#{self.class.name}")
-    LogStash::Util::Decorators.add_tags(@tags,event,"inputs/#{self.class.name}")
-  end
-
-  protected
-  def fix_streaming_codecs
-    require "logstash/codecs/plain"
-    require "logstash/codecs/line"
-    require "logstash/codecs/json"
-    require "logstash/codecs/json_lines"
-    case @codec
-      when LogStash::Codecs::Plain
-        @logger.info("Automatically switching from #{@codec.class.config_name} to line codec", :plugin => self.class.config_name)
-        @codec = LogStash::Codecs::Line.new("charset" => @codec.charset)
-      when LogStash::Codecs::JSON
-        @logger.info("Automatically switching from #{@codec.class.config_name} to json_lines codec", :plugin => self.class.config_name)
-        @codec = LogStash::Codecs::JSONLines.new("charset" => @codec.charset)
-    end
-  end
-end # class LogStash::Inputs::Base

data/vendor/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/inputs/threadable.rb

@@ -1,18 +0,0 @@
-# encoding: utf-8
-require "logstash/namespace"
-require "logstash/inputs/base"
-
-# This is the threadable class for logstash inputs. 
-# Use this class in your inputs if it can support multiple threads
-class LogStash::Inputs::Threadable < LogStash::Inputs::Base
-
-  # Set this to the number of threads you want this input to spawn.
-  # This is the same as declaring the input multiple times
-  config :threads, :validate => :number, :default => 1
- 
-  def initialize(params)
-    super
-    @threadable = true
-  end
-
-end # class LogStash::Inputs::Threadable