logstash-input-beats 0.9.3 → 0.9.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7a9401d85a618195a338e8faaee3287c85b1414c
-  data.tar.gz: ef3cdd4de1c0fea567ff29b8f43037046f4421f0
+  metadata.gz: b1047898fca8c088bad07177c83065b172ffa397
+  data.tar.gz: 30c529c2f394241878c37b9228c3bf099e963ccd
 SHA512:
-  metadata.gz: e92307aad4c185d634b0a4a41b732d88f0b8dceb50f23cbb55814e7bfde2ae1481e6de2a72b5aa71df81c297ac37856711e1653e5199b9ee725d8b4d768517d5
-  data.tar.gz: 74c5cc5071212c503c8ed1c054c400ea662304f793edddb7eb5f17d2b15b40b2d82d381d1c95cd81823590f592b16556299785b7362ddc35dd6d1039390cdd04
+  metadata.gz: f6f5fec20da96051d40ba23240b459ad3f3d50440ce1f3713fdfd91af281e1c96d2fee096349c66b13570a5c43312f74b73edc01b1d75b04383c9c0b39c76bec
+  data.tar.gz: 1bc58dfa1626cd59b7c1c76ed25d22c7b6ee1e9268ac91e3875ca052825f4aec08769d13ce2e09f83a95d2307fcb6a97261819caf2ef255b3d0ec95c41dd8cfe

data/CHANGELOG.md

@@ -1,3 +1,5 @@
+# 0.9.4
+  - Correctly decorate the event with the `add_field` and `tags` option from the config #12
 # 0.9.3
   - Connection#run should rescue `Broken Pipe Error` #5
   - Fix a `SystemCallErr` issue on windows when shutting down the server #9

data/lib/logstash/inputs/beats.rb

@@ -125,21 +125,22 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
     @lumberjack.close
   end
 
-  private
+  public
   def create_event(codec, map)
     # Filebeats uses the `message` key and LSF `line`
     target_field = target_field_for_codec ? map.delete(target_field_for_codec) : nil
 
     if target_field.nil?
-      return LogStash::Event.new(map)
+      event = LogStash::Event.new(map) 
+      decorate(event)
+      return event
     else
-
-      # All codes expects to work on string
+      # All codecs expects to work on string
       @codec.decode(target_field.to_s) do |decoded|
-        decorate(decoded)
         ts = coerce_ts(map.delete("@timestamp"))
         decoded["@timestamp"] = ts unless ts.nil?
         map.each { |k, v| decoded[k] = v }
+        decorate(decoded)
         return decoded
       end
     end
@@ -151,10 +152,10 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
     timestamp = LogStash::Timestamp.coerce(ts)
     return timestamp if timestamp
 
-    LOGGER.warn("Unrecognized @timestamp value, setting current time to @timestamp",
+    @logger.warn("Unrecognized @timestamp value, setting current time to @timestamp",
       :value => ts.inspect)
   rescue LogStash::TimestampParserError => e
-    LOGGER.warn("Error parsing @timestamp string, setting current time to @timestamp",
+    @logger.warn("Error parsing @timestamp string, setting current time to @timestamp",
       :value => ts.inspect, :exception => e.message)
   end
 

data/logstash-input-beats.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name            = "logstash-input-beats"
-  s.version         = "0.9.3"
+  s.version         = "0.9.4"
   s.licenses        = ["Apache License (2.0)"]
   s.summary         = "Receive events using the lumberjack protocol."
   s.description     = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"

data/spec/inputs/beats_spec.rb

@@ -72,28 +72,55 @@ describe LogStash::Inputs::Beats do
 
   describe "#processing of events" do
     subject(:beats) { LogStash::Inputs::Beats.new(config) }
+    let(:codec) { LogStash::Codecs::Multiline.new("pattern" => '\n', "what" => "previous") }
 
-    let(:lines) { {"line" => "one\ntwo\n  two.2\nthree\n", "tags" => ["syslog"]} }
-
-    before do
-      allow(connection).to receive(:run).and_yield(lines)
-      beats.register
-      expect_any_instance_of(Lumberjack::Beats::Server).to receive(:accept).and_return(connection)
+    let(:config) do
+      { "port" => port, "ssl_certificate" => certificate.ssl_cert, "ssl_key" => certificate.ssl_key,
+        "type" => "example", "codec" => codec }
     end
 
+
     context "#codecs" do
-      let(:config) do
-        { "port" => port, "ssl_certificate" => certificate.ssl_cert, "ssl_key" => certificate.ssl_key,
-          "type" => "example", "codec" => codec }
-      end
+      let(:lines) { {"line" => "one\ntwo\n  two.2\nthree\n", "tags" => ["syslog"]} }
 
-      let(:codec) { LogStash::Codecs::Multiline.new("pattern" => '\n', "what" => "previous") }
+      before do
+        allow(connection).to receive(:run).and_yield(lines)
+        beats.register
+        expect_any_instance_of(Lumberjack::Beats::Server).to receive(:accept).and_return(connection)
+      end
+      
       it "clone the codec per connection" do
         expect(beats.codec).to receive(:clone).once
         expect(beats).to receive(:invoke) { break }
         beats.run(queue)
       end
     end
+
+    context "#create_event" do
+      let(:config) { super.merge({ "add_field" => { "foo" => "bar", "[@metadata][hidden]" => "secret"}, "tags" => ["bonjour"]}) }
+      let(:event_map) { { "hello" => "world" } }
+      let(:codec) { LogStash::Codecs::Plain.new }
+
+      context "without a `target_field` defined" do
+        it "decorates the event" do
+          event = beats.create_event(codec, event_map)
+          expect(event["foo"]).to eq("bar")
+          expect(event["[@metadata][hidden]"]).to eq("secret")
+          expect(event["tags"]).to include("bonjour")
+        end
+      end
+
+      context "with a `target_field` defined" do
+        let(:event_map) { super.merge({"message" => "with a field"}) }
+
+        it "decorates the event" do
+          event = beats.create_event(beats.codec, event_map)
+          expect(event["foo"]).to eq("bar")
+          expect(event["[@metadata][hidden]"]).to eq("secret")
+          expect(event["tags"]).to include("bonjour")
+        end
+      end
+    end
   end
 
   unless LogStash::CompatibilityLayerApiV1.is_v1?

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-input-beats
 version: !ruby/object:Gem::Version
-  version: 0.9.3
+  version: 0.9.4
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2015-10-29 00:00:00.000000000 Z
+date: 2015-11-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core