logstash-input-eventlog 0.1.5-java → 0.1.6-java

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +0 -0
  3. data/NOTICE.TXT +5 -0
  4. data/README.md +1 -1
  5. data/lib/logstash/inputs/eventlog.rb +61 -51
  6. data/logstash-input-eventlog.gemspec +1 -1
  7. metadata +19 -17
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 0ec6867b31e5b68ae52ebef7fa0cdf5383316c67
4
- data.tar.gz: d526bb05c6d8d6514e0f524a2566fe09d0bd8a72
3
+ metadata.gz: f13c329a36f6b929b09ee978a555c75e0e9eab64
4
+ data.tar.gz: 43ecd5b9bd0bfb3c5cbc8597ef787262eafec6e2
5
5
  SHA512:
6
- metadata.gz: b972142ea70967acd9a66294a3b1efbc0e12ff93d4989e818aa2792f1efd71370c112fc9500e15aa0cd500539b99311a7f60a134b4b91e004a5a6187593877bc
7
- data.tar.gz: 68469e059f2e302c65649b0e4110e48d459979baf13abc688085fee521dba6e2e507d7c3832fa58c0e4c785b24228ef262491dcf29063eb4b5829bc5c61e24bb
6
+ metadata.gz: b0767c8d4d1c883d1a5d720988f10162576cb6658d3c4e37f73944f6bca7abfcc8d75e0265e5ac6ccef0b6a82c906c5e3d1f35f121030efce542191f566ced8b
7
+ data.tar.gz: d4d927c303db0878130950cb38256761834b96864c164113f82ccc573fb1713d8823974926c3897dc041639a36c284b82179cd9a81c994e15726f08cb521e94c
data/CHANGELOG.md ADDED
File without changes
data/NOTICE.TXT ADDED
@@ -0,0 +1,5 @@
1
+ Elasticsearch
2
+ Copyright 2012-2015 Elasticsearch
3
+
4
+ This product includes software developed by The Apache Software
5
+ Foundation (http://www.apache.org/).
data/README.md CHANGED
@@ -13,7 +13,7 @@ Logstash provides infrastructure to automatically generate documentation for thi
13
13
 
14
14
  ## Need Help?
15
15
 
16
- Need help? Try #logstash on freenode IRC or the logstash-users@googlegroups.com mailing list.
16
+ Need help? Try #logstash on freenode IRC or the https://discuss.elastic.co/c/logstash discussion forum.
17
17
 
18
18
  ## Developing
19
19
 
data/lib/logstash/inputs/eventlog.rb CHANGED
@@ -41,62 +41,72 @@ class LogStash::Inputs::EventLog < LogStash::Inputs::Base
41
41
 
42
42
  public
43
43
  def run(queue)
44
- @wmi = WIN32OLE.connect("winmgmts://")
45
44
 
45
+ @wmi = WIN32OLE.connect("winmgmts://")
46
46
  wmi_query = "Select * from __InstanceCreationEvent Where TargetInstance ISA 'Win32_NTLogEvent' And (TargetInstance.LogFile = '#{@logfiles}')"
47
47
 
48
+ @logger.debug("Tailing Windows Event Log '#{@logfile}'")
49
+
48
50
  begin
49
- @logger.debug("Tailing Windows Event Log '#{@logfile}'")
50
-
51
- events = @wmi.ExecNotificationQuery(wmi_query)
52
-
53
- loop do
54
- notification = events.NextEvent(1000) #timeout is 1000 ms
55
- event = notification.TargetInstance
56
-
57
- timestamp = to_timestamp(event.TimeGenerated)
58
-
59
- e = LogStash::Event.new(
60
- "host" => @hostname,
61
- "path" => @logfile,
62
- "type" => @type,
63
- LogStash::Event::TIMESTAMP => timestamp
64
- )
65
-
66
- %w{Category CategoryString ComputerName EventCode EventIdentifier
67
- EventType Logfile Message RecordNumber SourceName
68
- TimeGenerated TimeWritten Type User
69
- }.each{
70
- |property| e[property] = event.send property
71
- }
72
-
73
- if RUBY_PLATFORM == "java"
74
- # unwrap jruby-win32ole racob data
75
- e["InsertionStrings"] = unwrap_racob_variant_array(event.InsertionStrings)
76
- data = unwrap_racob_variant_array(event.Data)
77
- # Data is an array of signed shorts, so convert to bytes and pack a string
78
- e["Data"] = data.map{|byte| (byte > 0) ? byte : 256 + byte}.pack("c*")
79
- else
80
- # win32-ole data does not need to be unwrapped
81
- e["InsertionStrings"] = event.InsertionStrings
82
- e["Data"] = event.Data
83
- end
84
-
85
- e["message"] = event.Message
86
-
87
- decorate(e)
88
- queue << e
89
-
90
- end # loop
91
-
92
- rescue LogStash::ShutdownSignal
93
- return
94
- rescue Exception => ex
95
- @logger.error("Windows Event Log error: #{ex}\n#{ex.backtrace}")
96
- sleep 1
97
- retry
98
- end # rescue
51
+ @events = @wmi.ExecNotificationQuery(wmi_query)
52
+ rescue => e
53
+ @logger.fatal("Unable to tail Windows Event Log: #{e.message}")
54
+ @logger.info("Windows Event Log Query: #{wmi_query}")
55
+ return # fatal scenario => exit
56
+ end
99
57
 
58
+ loop do
59
+
60
+ begin
61
+ # timeout is needed here otherwise NextEvent prevents logstash from exiting
62
+ notification = @events.NextEvent(1000) # 1000 ms
63
+ rescue Java::OrgRacobCom::ComFailException
64
+ next
65
+ end
66
+
67
+ event = notification.TargetInstance
68
+
69
+ timestamp = to_timestamp(event.TimeGenerated)
70
+
71
+ e = LogStash::Event.new(
72
+ "host" => @hostname,
73
+ "path" => @logfile,
74
+ "type" => @type,
75
+ LogStash::Event::TIMESTAMP => timestamp
76
+ )
77
+
78
+ %w{Category CategoryString ComputerName EventCode EventIdentifier
79
+ EventType Logfile Message RecordNumber SourceName
80
+ TimeGenerated TimeWritten Type User
81
+ }.each{
82
+ |property| e[property] = event.send property
83
+ }
84
+
85
+ if RUBY_PLATFORM == "java"
86
+ # unwrap jruby-win32ole racob data
87
+ e["InsertionStrings"] = unwrap_racob_variant_array(event.InsertionStrings)
88
+ data = unwrap_racob_variant_array(event.Data)
89
+ # Data is an array of signed shorts, so convert to bytes and pack a string
90
+ e["Data"] = data.map{|byte| (byte > 0) ? byte : 256 + byte}.pack("c*")
91
+ else
92
+ # win32-ole data does not need to be unwrapped
93
+ e["InsertionStrings"] = event.InsertionStrings
94
+ e["Data"] = event.Data
95
+ end
96
+
97
+ e["message"] = event.Message
98
+
99
+ decorate(e)
100
+ queue << e
101
+
102
+ end # loop
103
+
104
+ rescue LogStash::ShutdownSignal
105
+ return
106
+ rescue => ex
107
+ @logger.error("Windows Event Log error: #{ex}\n#{ex.backtrace}")
108
+ sleep 1
109
+ retry
100
110
  end # def run
101
111
 
102
112
  private
data/logstash-input-eventlog.gemspec CHANGED
@@ -1,7 +1,7 @@
1
1
  Gem::Specification.new do |s|
2
2
 
3
3
  s.name = 'logstash-input-eventlog'
4
- s.version = '0.1.5'
4
+ s.version = '0.1.6'
5
5
  s.licenses = ['Apache License (2.0)']
6
6
  s.summary = "This input will pull events from a Windows Event Log"
7
7
  s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
metadata CHANGED
@@ -1,17 +1,18 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: logstash-input-eventlog
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.1.5
4
+ version: 0.1.6
5
5
  platform: java
6
6
  authors:
7
7
  - Elastic
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2015-04-20 00:00:00.000000000 Z
11
+ date: 2015-06-22 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
- requirement: !ruby/object:Gem::Requirement
14
+ name: logstash-core
15
+ version_requirements: !ruby/object:Gem::Requirement
15
16
  requirements:
16
17
  - - '>='
17
18
  - !ruby/object:Gem::Version
@@ -19,10 +20,7 @@ dependencies:
19
20
  - - <
20
21
  - !ruby/object:Gem::Version
21
22
  version: 2.0.0
22
- name: logstash-core
23
- prerelease: false
24
- type: :runtime
25
- version_requirements: !ruby/object:Gem::Requirement
23
+ requirement: !ruby/object:Gem::Requirement
26
24
  requirements:
27
25
  - - '>='
28
26
  - !ruby/object:Gem::Version
@@ -30,48 +28,50 @@ dependencies:
30
28
  - - <
31
29
  - !ruby/object:Gem::Version
32
30
  version: 2.0.0
31
+ prerelease: false
32
+ type: :runtime
33
33
  - !ruby/object:Gem::Dependency
34
+ name: logstash-codec-plain
35
+ version_requirements: !ruby/object:Gem::Requirement
36
+ requirements:
37
+ - - '>='
38
+ - !ruby/object:Gem::Version
39
+ version: '0'
34
40
  requirement: !ruby/object:Gem::Requirement
35
41
  requirements:
36
42
  - - '>='
37
43
  - !ruby/object:Gem::Version
38
44
  version: '0'
39
- name: logstash-codec-plain
40
45
  prerelease: false
41
46
  type: :runtime
47
+ - !ruby/object:Gem::Dependency
48
+ name: jruby-win32ole
42
49
  version_requirements: !ruby/object:Gem::Requirement
43
50
  requirements:
44
51
  - - '>='
45
52
  - !ruby/object:Gem::Version
46
53
  version: '0'
47
- - !ruby/object:Gem::Dependency
48
54
  requirement: !ruby/object:Gem::Requirement
49
55
  requirements:
50
56
  - - '>='
51
57
  - !ruby/object:Gem::Version
52
58
  version: '0'
53
- name: jruby-win32ole
54
59
  prerelease: false
55
60
  type: :runtime
61
+ - !ruby/object:Gem::Dependency
62
+ name: logstash-devutils
56
63
  version_requirements: !ruby/object:Gem::Requirement
57
64
  requirements:
58
65
  - - '>='
59
66
  - !ruby/object:Gem::Version
60
67
  version: '0'
61
- - !ruby/object:Gem::Dependency
62
68
  requirement: !ruby/object:Gem::Requirement
63
69
  requirements:
64
70
  - - '>='
65
71
  - !ruby/object:Gem::Version
66
72
  version: '0'
67
- name: logstash-devutils
68
73
  prerelease: false
69
74
  type: :development
70
- version_requirements: !ruby/object:Gem::Requirement
71
- requirements:
72
- - - '>='
73
- - !ruby/object:Gem::Version
74
- version: '0'
75
75
  description: This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program
76
76
  email: info@elastic.co
77
77
  executables: []
@@ -79,10 +79,12 @@ extensions: []
79
79
  extra_rdoc_files: []
80
80
  files:
81
81
  - .gitignore
82
+ - CHANGELOG.md
82
83
  - CONTRIBUTORS
83
84
  - Gemfile
84
85
  - Gemfile.bak
85
86
  - LICENSE
87
+ - NOTICE.TXT
86
88
  - README.md
87
89
  - Rakefile
88
90
  - lib/logstash/inputs/eventlog.rb