logstash-input-eventlog 4.0.2 → 4.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: cb284113772b8a70d2f7f1229728b8ccaa54ddd7
-  data.tar.gz: 0e528d1dcee47316eb4c7215ff4a6c23ba9a94ef
+  metadata.gz: 7175056b3a1ed2a08cb34f7504e63ed8d7bd4bb3
+  data.tar.gz: a4fae43c9205b93a430e3fd6acfb4016c7e1af35
 SHA512:
-  metadata.gz: a0942e86027206dbdf6ef11fd3f02014734e3c45d65233140fbf8dd6c6eba0d9f1f3f63ae4f9ae16f61454b71e918d992bd0f68e2a1b02f4132de1e553aa68ce
-  data.tar.gz: 78265ea813793e68e3c3c684a0f4f9636670529adf6ea09ccc5e5ff8757f7dff5e5efa4265b2cdf44a869e5480e7a5e3a04673e35b162de285ee93dcb8083cd3
+  metadata.gz: ed5c2ab0c3b02347b5f3dcb32bf51cd2b87d94024e2addfc4afeecb8315c72e265f7977e077c34631020830c55d7e1a09ec040216f3d95feb56f83df5d366cde
+  data.tar.gz: 5f6c28975d53b9a7ee50a7e6729951f7f9daec3fc5143b7f9583fc6fdcdf73efca8a6ea063969fe87fae6efb65999648393a047b5d0517b63f2b50575223a155

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 4.1.0
+  - Add a default charset converter from default UTF-16LE, the one
+    output default by windows event log to our very own UTF-8 encoding.
+
 ## 4.0.2
   - Relax constraint on logstash-core-plugin-api to >= 1.60 <= 2.99
 

data/Gemfile

@@ -1,4 +1,11 @@
 source 'https://rubygems.org'
 
-# Specify your gem's dependencies in logstash-mass_effect.gemspec
 gemspec
+
+logstash_path = ENV["LOGSTASH_PATH"] || "../../logstash"
+use_logstash_source = ENV["LOGSTASH_SOURCE"] && ENV["LOGSTASH_SOURCE"].to_s == "1"
+
+if Dir.exist?(logstash_path) && use_logstash_source
+  gem 'logstash-core', :path => "#{logstash_path}/logstash-core"
+  gem 'logstash-core-plugin-api', :path => "#{logstash_path}/logstash-core-plugin-api"
+end

data/docs/index.asciidoc

@@ -0,0 +1,74 @@
+:plugin: eventlog
+:type: input
+
+///////////////////////////////////////////
+START - GENERATED VARIABLES, DO NOT EDIT!
+///////////////////////////////////////////
+:version: %VERSION%
+:release_date: %RELEASE_DATE%
+:changelog_url: %CHANGELOG_URL%
+:include_path: ../../../../logstash/docs/include
+///////////////////////////////////////////
+END - GENERATED VARIABLES, DO NOT EDIT!
+///////////////////////////////////////////
+
+[id="plugins-{type}-{plugin}"]
+
+=== Eventlog
+
+include::{include_path}/plugin_header.asciidoc[]
+
+==== Description
+
+This input will pull events from a http://msdn.microsoft.com/en-us/library/windows/desktop/bb309026%28v=vs.85%29.aspx[Windows Event Log].
+Note that Windows Event Logs are stored on disk in a binary format and are only accessible from the Win32 API.
+This means Losgtash needs to be running as an agent on Windows servers where you wish to collect logs 
+from, and will not be accesible across the network.
+
+To collect Events from the System Event Log, use a config like:
+[source,ruby]
+    input {
+      eventlog {
+        type  => 'Win32-EventLog'
+        logfile  => 'System'
+      }
+    }
+
+[id="plugins-{type}s-{plugin}-options"]
+==== Eventlog Input Configuration Options
+
+This plugin supports the following configuration options plus the <<plugins-{type}s-{plugin}-common-options>> described later.
+
+[cols="<,<,<",options="header",]
+|=======================================================================
+|Setting |Input type|Required
+| <<plugins-{type}s-{plugin}-interval>> |<<number,number>>|No
+| <<plugins-{type}s-{plugin}-logfile>> |<<string,string>>, one of `["Application", "Security", "System"]`|No
+|=======================================================================
+
+Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
+input plugins.
+
+&nbsp;
+
+[id="plugins-{type}s-{plugin}-interval"]
+===== `interval` 
+
+  * Value type is <<number,number>>
+  * Default value is `1000`
+
+How frequently should tail check for new event logs in ms (default: 1 second)
+
+[id="plugins-{type}s-{plugin}-logfile"]
+===== `logfile` 
+
+  * Value can be any of: `Application`, `Security`, `System`
+  * Default value is `"Application"`
+
+Event Log Name
+System and Security may require that privileges are given to the user running logstash.
+see more at: https://social.technet.microsoft.com/forums/windowsserver/en-US/d2f813db-6142-4b5b-8d86-253ebb740473/easy-way-to-read-security-log
+
+
+[id="plugins-{type}s-{plugin}-common-options"]
+include::{include_path}/{type}.asciidoc[]

data/lib/logstash/inputs/eventlog.rb

@@ -4,6 +4,8 @@ require "logstash/namespace"
 require "logstash/timestamp"
 require "win32/eventlog"
 require "stud/interval"
+require "logstash/util/charset"
+
 
 # This input will pull events from a http://msdn.microsoft.com/en-us/library/windows/desktop/bb309026%28v=vs.85%29.aspx[Windows Event Log].
 # Note that Windows Event Logs are stored on disk in a binary format and are only accessible from the Win32 API.
@@ -32,6 +34,10 @@ class LogStash::Inputs::EventLog < LogStash::Inputs::Base
   # How frequently should tail check for new event logs in ms (default: 1 second)
   config :interval, :validate => :number, :default => 1000
 
+  # Event Log string encoding (default: UTF-16LE), however your system might be using another encoding, if you
+  # are seeing strange characters, inspect this variable.
+  config :charset, :validate => :string, :default => "UTF-16LE"
+
   public
   def register
 
@@ -47,6 +53,7 @@ class LogStash::Inputs::EventLog < LogStash::Inputs::Base
       end
       raise
     end
+    @converter = LogStash::Util::Charset.new(Encoding.find(@charset))
   end # def register
 
   public
@@ -73,7 +80,7 @@ class LogStash::Inputs::EventLog < LogStash::Inputs::Base
   private
   def process(log)
 
-    LogStash::Event.new(
+    attrs = {
       "host"             => @hostname,
       "Logfile"          => @logfile,
       "message"          => log["description"].strip,
@@ -88,8 +95,25 @@ class LogStash::Inputs::EventLog < LogStash::Inputs::Base
       "Type"             => log["event_type"],
       "User"             => log["user"],
       "InsertionStrings" => log["string_inserts"]
-    )
+    }
+
+    attrs.each do |k,v|
+      next if ["host", "Logfile"].include?(k)
+      attrs[k] = convert(v)
+    end
+
+    LogStash::Event.new(attrs)
   end # def run
 
+  def convert(field)
+    if field.is_a?(String)
+      @converter.convert(field)
+    elsif field.is_a?(Array)
+      field.map { |v| @converter.convert(v) }
+    else
+      field
+    end
+  end
+
 end # class LogStash::Inputs::EventLog
 

data/logstash-input-eventlog.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-input-eventlog'
-  s.version         = '4.0.2'
+  s.version         = '4.1.1'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "This input will pull events from a Windows Event Log"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
@@ -11,7 +11,7 @@ Gem::Specification.new do |s|
   s.require_paths = ["lib"]
 
   # Files
-  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
+  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT', 'docs/**/*']
 
   # Tests
   s.test_files = s.files.grep(%r{^(test|spec|features)/})

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-input-eventlog
 version: !ruby/object:Gem::Version
-  version: 4.0.2
+  version: 4.1.1
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2016-07-14 00:00:00.000000000 Z
+date: 2017-06-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -98,6 +98,7 @@ files:
 - LICENSE
 - NOTICE.TXT
 - README.md
+- docs/index.asciidoc
 - lib/logstash/inputs/eventlog.rb
 - logstash-input-eventlog.gemspec
 - spec/inputs/eventlog_spec.rb
@@ -123,7 +124,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project:
-rubygems_version: 2.6.3
+rubygems_version: 2.4.8
 signing_key:
 specification_version: 4
 summary: This input will pull events from a Windows Event Log