logstash-input-imap 3.1.0 → 3.2.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +9 -0
- data/README.md +1 -1
- data/docs/index.asciidoc +51 -2
- data/lib/logstash/inputs/imap.rb +88 -43
- data/logstash-input-imap.gemspec +5 -5
- data/spec/inputs/imap_spec.rb +180 -86
- metadata +27 -28
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 3f39d56e92b214ea882711074b5bc1e18494cae59593bc6ae3f0c148d31f92d6
|
4
|
+
data.tar.gz: f4ee0a61e683ed91dc12939b0e908614be4f86c0889b2ec77313f23edca0e106
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: b779ca617b2cdf49546cf935c6fec06ed874e6668938db53c10833fc9158138e6adbd12d0fdde76f4775d8584c92e7257a1723366f3a0bb8414849404bb5dba1
|
7
|
+
data.tar.gz: 8b2e4f3ff554a873fe2fc514f6ea06005267ab789af4ebeac672a320cccb8d7847015ef5e5170db8b5801a13627efd9ee76a93bef49cf0b709ad0e5a9b629b84
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,12 @@
|
|
1
|
+
## 3.2.1
|
2
|
+
- Upgrade `email` dependency so that supports Ruby 3.1. This also fixes the `net-smtp` load regression [#60](https://github.com/logstash-plugins/logstash-input-imap/pull/60)
|
3
|
+
|
4
|
+
## 3.2.0
|
5
|
+
- Feat: ECS compatibility [#55](https://github.com/logstash-plugins/logstash-input-imap/pull/55)
|
6
|
+
* added (optional) `headers_target` configuration option
|
7
|
+
* added (optional) `attachments_target` configuration option
|
8
|
+
- Fix: plugin should not close `$stdin`, while being stopped
|
9
|
+
|
1
10
|
## 3.1.0
|
2
11
|
- Adds an option to recursively search the message parts for attachment and inline attachment filenames. If the save_attachments option is set to true, the content of attachments is included in the `attachments.data` field. The attachment data can then be used by the Elasticsearch Ingest Attachment Processor Plugin.
|
3
12
|
[#48](https://github.com/logstash-plugins/logstash-input-imap/pull/48)
|
data/README.md
CHANGED
@@ -1,6 +1,6 @@
|
|
1
1
|
# Logstash Plugin
|
2
2
|
|
3
|
-
[![Travis Build Status](https://travis-ci.
|
3
|
+
[![Travis Build Status](https://travis-ci.com/logstash-plugins/logstash-input-imap.svg)](https://travis-ci.com/logstash-plugins/logstash-input-imap)
|
4
4
|
|
5
5
|
This is a plugin for [Logstash](https://github.com/elastic/logstash).
|
6
6
|
|
data/docs/index.asciidoc
CHANGED
@@ -26,6 +26,15 @@ Read mails from IMAP server
|
|
26
26
|
Periodically scan an IMAP folder (`INBOX` by default) and move any read messages
|
27
27
|
to the trash.
|
28
28
|
|
29
|
+
[id="plugins-{type}s-{plugin}-ecs"]
|
30
|
+
==== Compatibility with the Elastic Common Schema (ECS)
|
31
|
+
|
32
|
+
The plugin includes sensible defaults that change based on <<plugins-{type}s-{plugin}-ecs_compatibility,ECS compatibility mode>>.
|
33
|
+
When ECS compatibility is disabled, mail headers and attachments are targeted at the root level.
|
34
|
+
When targeting an ECS version, headers and attachments target `@metadata` sub-fields unless configured otherwise in order
|
35
|
+
to avoid conflict with ECS fields.
|
36
|
+
See <<plugins-{type}s-{plugin}-headers_target>>, and <<plugins-{type}s-{plugin}-attachments_target>>.
|
37
|
+
|
29
38
|
[id="plugins-{type}s-{plugin}-options"]
|
30
39
|
==== Imap Input Configuration Options
|
31
40
|
|
@@ -34,12 +43,15 @@ This plugin supports the following configuration options plus the <<plugins-{typ
|
|
34
43
|
[cols="<,<,<",options="header",]
|
35
44
|
|=======================================================================
|
36
45
|
|Setting |Input type|Required
|
46
|
+
| <<plugins-{type}s-{plugin}-attachments_target>> |<<string,string>>|No
|
37
47
|
| <<plugins-{type}s-{plugin}-check_interval>> |<<number,number>>|No
|
38
48
|
| <<plugins-{type}s-{plugin}-content_type>> |<<string,string>>|No
|
39
49
|
| <<plugins-{type}s-{plugin}-delete>> |<<boolean,boolean>>|No
|
50
|
+
| <<plugins-{type}s-{plugin}-ecs_compatibility>> |<<string,string>>|No
|
40
51
|
| <<plugins-{type}s-{plugin}-expunge>> |<<boolean,boolean>>|No
|
41
52
|
| <<plugins-{type}s-{plugin}-fetch_count>> |<<number,number>>|No
|
42
53
|
| <<plugins-{type}s-{plugin}-folder>> |<<string,string>>|No
|
54
|
+
| <<plugins-{type}s-{plugin}-headers_target>> |<<string,string>>|No
|
43
55
|
| <<plugins-{type}s-{plugin}-host>> |<<string,string>>|Yes
|
44
56
|
| <<plugins-{type}s-{plugin}-lowercase_headers>> |<<boolean,boolean>>|No
|
45
57
|
| <<plugins-{type}s-{plugin}-password>> |<<password,password>>|Yes
|
@@ -58,6 +70,16 @@ input plugins.
|
|
58
70
|
|
59
71
|
|
60
72
|
|
73
|
+
[id="plugins-{type}s-{plugin}-attachments_target"]
|
74
|
+
===== `attachments_target`
|
75
|
+
|
76
|
+
* Value type is <<string,string>>
|
77
|
+
* Default value depends on whether <<plugins-{type}s-{plugin}-ecs_compatibility>> is enabled:
|
78
|
+
** ECS Compatibility disabled: `"[attachments]"`
|
79
|
+
** ECS Compatibility enabled: `"[@metadata][input][imap][attachments]"
|
80
|
+
|
81
|
+
The name of the field under which mail attachments information will be added, if <<plugins-{type}s-{plugin}-save_attachments>> is set.
|
82
|
+
|
61
83
|
[id="plugins-{type}s-{plugin}-check_interval"]
|
62
84
|
===== `check_interval`
|
63
85
|
|
@@ -72,8 +94,7 @@ input plugins.
|
|
72
94
|
* Value type is <<string,string>>
|
73
95
|
* Default value is `"text/plain"`
|
74
96
|
|
75
|
-
For multipart messages, use the first part that has this
|
76
|
-
content-type as the event message.
|
97
|
+
For multipart messages, use the first part that has this content-type as the event message.
|
77
98
|
|
78
99
|
[id="plugins-{type}s-{plugin}-delete"]
|
79
100
|
===== `delete`
|
@@ -83,6 +104,21 @@ content-type as the event message.
|
|
83
104
|
|
84
105
|
|
85
106
|
|
107
|
+
[id="plugins-{type}s-{plugin}-ecs_compatibility"]
|
108
|
+
===== `ecs_compatibility`
|
109
|
+
|
110
|
+
* Value type is <<string,string>>
|
111
|
+
* Supported values are:
|
112
|
+
** `disabled`: does not use ECS-compatible field names (for example, `From` header field is added to the event)
|
113
|
+
** `v1`, `v8`: avoids field names that might conflict with Elastic Common Schema (for example, the `From` header is added as metadata)
|
114
|
+
* Default value depends on which version of Logstash is running:
|
115
|
+
** When Logstash provides a `pipeline.ecs_compatibility` setting, its value is used as the default
|
116
|
+
** Otherwise, the default value is `disabled`.
|
117
|
+
|
118
|
+
Controls this plugin's compatibility with the {ecs-ref}[Elastic Common Schema (ECS)].
|
119
|
+
The value of this setting affects the _default_ value of <<plugins-{type}s-{plugin}-headers_target>> and
|
120
|
+
<<plugins-{type}s-{plugin}-attachments_target>>.
|
121
|
+
|
86
122
|
[id="plugins-{type}s-{plugin}-expunge"]
|
87
123
|
===== `expunge`
|
88
124
|
|
@@ -107,6 +143,19 @@ content-type as the event message.
|
|
107
143
|
|
108
144
|
|
109
145
|
|
146
|
+
[id="plugins-{type}s-{plugin}-headers_target"]
|
147
|
+
===== `headers_target`
|
148
|
+
|
149
|
+
* Value type is <<string,string>>
|
150
|
+
* Default value depends on whether <<plugins-{type}s-{plugin}-ecs_compatibility>> is enabled:
|
151
|
+
** ECS Compatibility disabled: no default value (for example, the subject header is stored under the `"subject"` name)
|
152
|
+
** ECS Compatibility enabled: `"[@metadata][input][imap][headers]"`
|
153
|
+
|
154
|
+
The name of the field under which mail headers will be added.
|
155
|
+
|
156
|
+
Setting `headers_target => ''` skips headers processing and no header is added to the event.
|
157
|
+
Except the date header, if present, which is always used as the event's `@timestamp`.
|
158
|
+
|
110
159
|
[id="plugins-{type}s-{plugin}-host"]
|
111
160
|
===== `host`
|
112
161
|
|
data/lib/logstash/inputs/imap.rb
CHANGED
@@ -3,13 +3,22 @@ require "logstash/inputs/base"
|
|
3
3
|
require "logstash/namespace"
|
4
4
|
require "logstash/timestamp"
|
5
5
|
require "stud/interval"
|
6
|
-
require
|
6
|
+
require 'fileutils'
|
7
|
+
|
8
|
+
require 'logstash/plugin_mixins/ecs_compatibility_support'
|
9
|
+
require 'logstash/plugin_mixins/ecs_compatibility_support/target_check'
|
10
|
+
require 'logstash/plugin_mixins/validator_support/field_reference_validation_adapter'
|
7
11
|
|
8
12
|
# Read mails from IMAP server
|
9
13
|
#
|
10
14
|
# Periodically scan an IMAP folder (`INBOX` by default) and move any read messages
|
11
15
|
# to the trash.
|
12
16
|
class LogStash::Inputs::IMAP < LogStash::Inputs::Base
|
17
|
+
|
18
|
+
include LogStash::PluginMixins::ECSCompatibilitySupport(:disabled, :v1, :v8 => :v1)
|
19
|
+
|
20
|
+
extend LogStash::PluginMixins::ValidatorSupport::FieldReferenceValidationAdapter
|
21
|
+
|
13
22
|
config_name "imap"
|
14
23
|
|
15
24
|
default :codec, "plain"
|
@@ -24,15 +33,23 @@ class LogStash::Inputs::IMAP < LogStash::Inputs::Base
|
|
24
33
|
|
25
34
|
config :folder, :validate => :string, :default => 'INBOX'
|
26
35
|
config :fetch_count, :validate => :number, :default => 50
|
27
|
-
config :lowercase_headers, :validate => :boolean, :default => true
|
28
36
|
config :check_interval, :validate => :number, :default => 300
|
37
|
+
|
38
|
+
config :lowercase_headers, :validate => :boolean, :default => true
|
39
|
+
|
40
|
+
config :headers_target, :validate => :field_reference # ECS default: [@metadata][input][imap][headers]
|
41
|
+
|
29
42
|
config :delete, :validate => :boolean, :default => false
|
30
43
|
config :expunge, :validate => :boolean, :default => false
|
44
|
+
|
31
45
|
config :strip_attachments, :validate => :boolean, :default => false
|
32
46
|
config :save_attachments, :validate => :boolean, :default => false
|
33
47
|
|
34
|
-
#
|
35
|
-
#
|
48
|
+
# Legacy default: [attachments]
|
49
|
+
# ECS default: [@metadata][input][imap][attachments]
|
50
|
+
config :attachments_target, :validate => :field_reference
|
51
|
+
|
52
|
+
# For multipart messages, use the first part that has this content-type as the event message.
|
36
53
|
config :content_type, :validate => :string, :default => "text/plain"
|
37
54
|
|
38
55
|
# Whether to use IMAP uid to track last processed message
|
@@ -41,6 +58,32 @@ class LogStash::Inputs::IMAP < LogStash::Inputs::Base
|
|
41
58
|
# Path to file with last run time metadata
|
42
59
|
config :sincedb_path, :validate => :string, :required => false
|
43
60
|
|
61
|
+
def initialize(*params)
|
62
|
+
super
|
63
|
+
|
64
|
+
if original_params.include?('headers_target')
|
65
|
+
@headers_target = normalize_field_ref(headers_target)
|
66
|
+
else
|
67
|
+
# NOTE: user specified `headers_target => ''` means disable headers (@headers_target == nil)
|
68
|
+
# unlike our default here (@headers_target == '') causes setting headers at top level ...
|
69
|
+
@headers_target = ecs_compatibility != :disabled ? '[@metadata][input][imap][headers]' : ''
|
70
|
+
end
|
71
|
+
|
72
|
+
if original_params.include?('attachments_target')
|
73
|
+
@attachments_target = normalize_field_ref(attachments_target)
|
74
|
+
else
|
75
|
+
@attachments_target = ecs_compatibility != :disabled ? '[@metadata][input][imap][attachments]' : '[attachments]'
|
76
|
+
end
|
77
|
+
end
|
78
|
+
|
79
|
+
# @note a '' target value is normalized to nil
|
80
|
+
def normalize_field_ref(target)
|
81
|
+
return nil if target.nil? || target.empty?
|
82
|
+
# so we can later event.set("#{target}[#{name}]", ...)
|
83
|
+
target.match?(/\A[^\[\]]+\z/) ? "[#{target}]" : target
|
84
|
+
end
|
85
|
+
private :normalize_field_ref
|
86
|
+
|
44
87
|
def register
|
45
88
|
require "net/imap" # in stdlib
|
46
89
|
require "mail" # gem 'mail'
|
@@ -63,14 +106,15 @@ class LogStash::Inputs::IMAP < LogStash::Inputs::Base
|
|
63
106
|
# Ensure that the filepath exists before writing, since it's deeply nested.
|
64
107
|
FileUtils::mkdir_p datapath
|
65
108
|
@sincedb_path = File.join(datapath, ".sincedb_" + Digest::MD5.hexdigest("#{@user}_#{@host}_#{@port}_#{@folder}"))
|
109
|
+
@logger.debug? && @logger.debug("Generated sincedb path", sincedb_path: @sincedb_path)
|
66
110
|
end
|
67
|
-
|
68
|
-
raise ArgumentError.new("The \"sincedb_path\" argument must point to a file, received a directory: \"#{@sincedb_path}\"")
|
69
|
-
end
|
70
|
-
@logger.info("Using \"sincedb_path\": \"#{@sincedb_path}\"")
|
111
|
+
@logger.info("Using", sincedb_path: @sincedb_path)
|
71
112
|
if File.exist?(@sincedb_path)
|
113
|
+
if File.directory?(@sincedb_path)
|
114
|
+
raise ArgumentError.new("The \"sincedb_path\" argument must point to a file, received a directory: \"#{@sincedb_path}\"")
|
115
|
+
end
|
72
116
|
@uid_last_value = File.read(@sincedb_path).to_i
|
73
|
-
@logger.
|
117
|
+
@logger.debug? && @logger.debug("Loaded from sincedb", uid_last_value: @uid_last_value)
|
74
118
|
end
|
75
119
|
|
76
120
|
@content_type_re = Regexp.new("^" + @content_type)
|
@@ -136,7 +180,6 @@ class LogStash::Inputs::IMAP < LogStash::Inputs::Base
|
|
136
180
|
rescue => e
|
137
181
|
@logger.error("Encountered error #{e.class}", :message => e.message, :backtrace => e.backtrace)
|
138
182
|
# Do not raise error, check_mail will be invoked in the next run time
|
139
|
-
|
140
183
|
ensure
|
141
184
|
# Close the connection (and ignore errors)
|
142
185
|
imap.close rescue nil
|
@@ -145,7 +188,7 @@ class LogStash::Inputs::IMAP < LogStash::Inputs::Base
|
|
145
188
|
# Always save @uid_last_value so when tracking is switched from
|
146
189
|
# "NOT SEEN" to "UID" we will continue from first unprocessed message
|
147
190
|
if @uid_last_value
|
148
|
-
@logger.
|
191
|
+
@logger.debug? && @logger.debug("Saving to sincedb", uid_last_value: @uid_last_value)
|
149
192
|
File.write(@sincedb_path, @uid_last_value)
|
150
193
|
end
|
151
194
|
end
|
@@ -164,7 +207,8 @@ class LogStash::Inputs::IMAP < LogStash::Inputs::Base
|
|
164
207
|
|
165
208
|
def parse_mail(mail)
|
166
209
|
# Add a debug message so we can track what message might cause an error later
|
167
|
-
@logger.debug? && @logger.debug("
|
210
|
+
@logger.debug? && @logger.debug("Processing mail", message_id: mail.message_id)
|
211
|
+
|
168
212
|
# TODO(sissel): What should a multipart message look like as an event?
|
169
213
|
# For now, just take the plain-text part and set it as the message.
|
170
214
|
if mail.parts.count == 0
|
@@ -183,35 +227,11 @@ class LogStash::Inputs::IMAP < LogStash::Inputs::Base
|
|
183
227
|
# Use the 'Date' field as the timestamp
|
184
228
|
event.timestamp = LogStash::Timestamp.new(mail.date.to_time)
|
185
229
|
|
186
|
-
|
187
|
-
mail.header_fields.each do |header|
|
188
|
-
# 'header.name' can sometimes be a Mail::Multibyte::Chars, get it in String form
|
189
|
-
name = @lowercase_headers ? header.name.to_s.downcase : header.name.to_s
|
190
|
-
# Call .decoded on the header in case it's in encoded-word form.
|
191
|
-
# Details at:
|
192
|
-
# https://github.com/mikel/mail/blob/master/README.md#encodings
|
193
|
-
# http://tools.ietf.org/html/rfc2047#section-2
|
194
|
-
value = transcode_to_utf8(header.decoded.to_s)
|
195
|
-
|
196
|
-
# Assume we already processed the 'date' above.
|
197
|
-
next if name == "Date"
|
198
|
-
|
199
|
-
case (field = event.get(name))
|
200
|
-
when String
|
201
|
-
# promote string to array if a header appears multiple times
|
202
|
-
# (like 'received')
|
203
|
-
event.set(name, [field, value])
|
204
|
-
when Array
|
205
|
-
field << value
|
206
|
-
event.set(name, field)
|
207
|
-
when nil
|
208
|
-
event.set(name, value)
|
209
|
-
end
|
210
|
-
end
|
230
|
+
process_headers(mail, event) if @headers_target
|
211
231
|
|
212
232
|
# Add attachments
|
213
|
-
if attachments && attachments.length > 0
|
214
|
-
event.set(
|
233
|
+
if attachments && attachments.length > 0 && @attachments_target
|
234
|
+
event.set(@attachments_target, attachments)
|
215
235
|
end
|
216
236
|
|
217
237
|
decorate(event)
|
@@ -219,9 +239,35 @@ class LogStash::Inputs::IMAP < LogStash::Inputs::Base
|
|
219
239
|
end
|
220
240
|
end
|
221
241
|
|
242
|
+
def process_headers(mail, event)
|
243
|
+
# Add fields: Add message.header_fields { |h| h.name=> h.value }
|
244
|
+
mail.header_fields.each do |header|
|
245
|
+
# 'header.name' can sometimes be a Mail::Multibyte::Chars, get it in String form
|
246
|
+
name = header.name.to_s
|
247
|
+
name = name.downcase if @lowercase_headers
|
248
|
+
|
249
|
+
# Call .decoded on the header in case it's in encoded-word form.
|
250
|
+
# Details at:
|
251
|
+
# https://github.com/mikel/mail/blob/master/README.md#encodings
|
252
|
+
# http://tools.ietf.org/html/rfc2047#section-2
|
253
|
+
value = transcode_to_utf8(header.decoded)
|
254
|
+
|
255
|
+
targeted_name = "#{@headers_target}[#{name}]"
|
256
|
+
case (field = event.get(targeted_name))
|
257
|
+
when String
|
258
|
+
# promote string to array if a header appears multiple times (like 'received')
|
259
|
+
event.set(targeted_name, [field, value])
|
260
|
+
when Array
|
261
|
+
field << value
|
262
|
+
event.set(targeted_name, field)
|
263
|
+
when nil
|
264
|
+
event.set(targeted_name, value)
|
265
|
+
end
|
266
|
+
end
|
267
|
+
end
|
268
|
+
|
222
269
|
def stop
|
223
270
|
Stud.stop!(@run_thread)
|
224
|
-
$stdin.close
|
225
271
|
end
|
226
272
|
|
227
273
|
private
|
@@ -230,8 +276,7 @@ class LogStash::Inputs::IMAP < LogStash::Inputs::Base
|
|
230
276
|
# the mail gem will set the correct encoding on header strings decoding
|
231
277
|
# and we want to transcode it to utf8
|
232
278
|
def transcode_to_utf8(s)
|
233
|
-
|
234
|
-
|
235
|
-
end
|
279
|
+
return nil if s.nil?
|
280
|
+
s.encode(Encoding::UTF_8, :invalid => :replace, :undef => :replace)
|
236
281
|
end
|
237
282
|
end
|
data/logstash-input-imap.gemspec
CHANGED
@@ -1,13 +1,13 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-input-imap'
|
4
|
-
s.version = '3.1
|
4
|
+
s.version = '3.2.1'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "Reads mail from an IMAP server"
|
7
7
|
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
8
8
|
s.authors = ["Elastic"]
|
9
9
|
s.email = 'info@elastic.co'
|
10
|
-
s.homepage = "
|
10
|
+
s.homepage = "https://www.elastic.co/logstash"
|
11
11
|
s.require_paths = ["lib"]
|
12
12
|
|
13
13
|
# Files
|
@@ -21,11 +21,11 @@ Gem::Specification.new do |s|
|
|
21
21
|
|
22
22
|
# Gem dependencies
|
23
23
|
s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
|
24
|
+
s.add_runtime_dependency 'logstash-mixin-ecs_compatibility_support', '~> 1.3'
|
25
|
+
s.add_runtime_dependency 'logstash-mixin-validator_support', '~> 1.0'
|
24
26
|
s.add_runtime_dependency 'logstash-codec-plain'
|
25
|
-
s.add_runtime_dependency 'mail', '~> 2.
|
26
|
-
s.add_runtime_dependency 'mime-types', '2.6.2'
|
27
|
+
s.add_runtime_dependency 'mail', '~> 2.8'
|
27
28
|
s.add_runtime_dependency 'stud', '~> 0.0.22'
|
28
29
|
|
29
30
|
s.add_development_dependency 'logstash-devutils'
|
30
|
-
s.add_development_dependency 'insist'
|
31
31
|
end
|
data/spec/inputs/imap_spec.rb
CHANGED
@@ -1,13 +1,12 @@
|
|
1
1
|
# encoding: utf-8
|
2
2
|
require "logstash/devutils/rspec/spec_helper"
|
3
|
-
require "insist"
|
4
3
|
require "logstash/devutils/rspec/shared_examples"
|
4
|
+
require 'logstash/plugin_mixins/ecs_compatibility_support/spec_helper'
|
5
5
|
require "logstash/inputs/imap"
|
6
6
|
require "mail"
|
7
7
|
require "net/imap"
|
8
8
|
require "base64"
|
9
9
|
|
10
|
-
|
11
10
|
describe LogStash::Inputs::IMAP do
|
12
11
|
|
13
12
|
context "when interrupting the plugin" do
|
@@ -36,7 +35,7 @@ describe LogStash::Inputs::IMAP do
|
|
36
35
|
|
37
36
|
end
|
38
37
|
|
39
|
-
describe LogStash::Inputs::IMAP do
|
38
|
+
describe LogStash::Inputs::IMAP, :ecs_compatibility_support do
|
40
39
|
user = "logstash"
|
41
40
|
password = "secret"
|
42
41
|
msg_time = Time.new
|
@@ -45,129 +44,224 @@ describe LogStash::Inputs::IMAP do
|
|
45
44
|
msg_binary = "\x42\x43\x44"
|
46
45
|
msg_unencoded = "raw text 🐐"
|
47
46
|
|
48
|
-
|
47
|
+
let(:config) do
|
48
|
+
{ "host" => "localhost", "user" => "#{user}", "password" => "#{password}" }
|
49
|
+
end
|
50
|
+
|
51
|
+
subject(:input) do
|
52
|
+
LogStash::Inputs::IMAP.new config
|
53
|
+
end
|
54
|
+
|
55
|
+
let(:mail) do
|
49
56
|
Mail.new do
|
50
57
|
from "me@example.com"
|
51
58
|
to "you@example.com"
|
52
59
|
subject "logstash imap input test"
|
53
60
|
date msg_time
|
54
61
|
body msg_text
|
62
|
+
message_id '<123@message.id>' # 'Message-ID' header
|
63
|
+
# let's have some headers:
|
64
|
+
header['X-Priority'] = '3'
|
65
|
+
header['X-Bot-ID'] = '111'
|
66
|
+
header['X-AES-Category'] = 'LEGIT'
|
67
|
+
header['X-Spam-Category'] = 'LEGIT'
|
68
|
+
header['Spam-Stopper-Id'] = '464bbb1a-1b86-4006-8a09-ce797fb56346'
|
69
|
+
header['Spam-Stopper-v2'] = 'Yes'
|
70
|
+
header['X-Mailer'] = 'Microsoft Outlook Express 6.00.2800.1106'
|
71
|
+
header['X-MimeOLE'] = 'Produced By Microsoft MimeOLE V6.00.2800.1106'
|
55
72
|
add_file :filename => "some.html", :content => msg_html
|
56
73
|
add_file :filename => "image.png", :content => msg_binary
|
57
74
|
add_file :filename => "unencoded.data", :content => msg_unencoded, :content_transfer_encoding => "7bit"
|
58
75
|
end
|
59
76
|
end
|
60
77
|
|
61
|
-
|
78
|
+
before do
|
79
|
+
input.register
|
80
|
+
end
|
81
|
+
|
82
|
+
ecs_compatibility_matrix(:disabled, :v1, :v8) do |ecs_select|
|
83
|
+
|
84
|
+
let(:ecs_compatibility?) { ecs_select.active_mode != :disabled }
|
85
|
+
|
86
|
+
let (:config) { super().merge('ecs_compatibility' => ecs_select.active_mode) }
|
87
|
+
|
62
88
|
context "when no content-type selected" do
|
63
89
|
it "should select text/plain part" do
|
64
|
-
|
65
|
-
|
66
|
-
|
67
|
-
input = LogStash::Inputs::IMAP.new config
|
68
|
-
input.register
|
69
|
-
event = input.parse_mail(subject)
|
70
|
-
insist { event.get("message") } == msg_text
|
90
|
+
event = input.parse_mail(mail)
|
91
|
+
expect( event.get("message") ).to eql msg_text
|
71
92
|
end
|
72
93
|
end
|
73
94
|
|
74
95
|
context "when text/html content-type selected" do
|
96
|
+
let(:config) { super().merge("content_type" => "text/html") }
|
97
|
+
|
75
98
|
it "should select text/html part" do
|
76
|
-
|
77
|
-
|
78
|
-
|
99
|
+
event = input.parse_mail(mail)
|
100
|
+
expect( event.get("message") ).to eql msg_html
|
101
|
+
end
|
102
|
+
end
|
103
|
+
|
104
|
+
context "mail headers" do
|
105
|
+
let(:config) { super().merge("lowercase_headers" => true) } # default
|
79
106
|
|
80
|
-
|
81
|
-
|
82
|
-
|
83
|
-
|
107
|
+
before { @event = input.parse_mail(mail) }
|
108
|
+
|
109
|
+
it "sets all header fields" do
|
110
|
+
if ecs_compatibility?
|
111
|
+
expect( @event.get("[@metadata][input][imap][headers][x-spam-category]") ).to eql 'LEGIT'
|
112
|
+
expect( @event.get("[@metadata][input][imap][headers][x-aes-category]") ).to eql 'LEGIT'
|
113
|
+
expect( @event.get("[@metadata][input][imap][headers][x-bot-id]") ).to eql '111'
|
114
|
+
['spam-stopper-id', 'spam-stopper-v2', 'x-mimeole', 'message-id', 'x-priority'].each do |name|
|
115
|
+
expect( @event.include?("[@metadata][input][imap][headers][#{name}]") ).to be true
|
116
|
+
end
|
117
|
+
expect( @event.get("[@metadata][input][imap][headers][from]") ).to eql 'me@example.com'
|
118
|
+
expect( @event.get("[@metadata][input][imap][headers][to]") ).to eql 'you@example.com'
|
119
|
+
expect( @event.get("[@metadata][input][imap][headers][subject]") ).to eql 'logstash imap input test'
|
120
|
+
else
|
121
|
+
expect( @event.get("x-spam-category") ).to eql 'LEGIT'
|
122
|
+
expect( @event.get("x-aes-category") ).to eql 'LEGIT'
|
123
|
+
expect( @event.get("x-bot-id") ).to eql '111'
|
124
|
+
['spam-stopper-id', 'spam-stopper-v2', 'x-mimeole', 'message-id', 'x-priority'].each do |name|
|
125
|
+
expect( @event.include?(name) ).to be true
|
126
|
+
end
|
127
|
+
expect( @event.get("from") ).to eql 'me@example.com'
|
128
|
+
expect( @event.get("to") ).to eql 'you@example.com'
|
129
|
+
expect( @event.get("subject") ).to eql 'logstash imap input test'
|
130
|
+
end
|
131
|
+
end
|
132
|
+
|
133
|
+
it 'does include the date header' do
|
134
|
+
expect( @event.include?('date') ).to be true unless ecs_compatibility?
|
135
|
+
expect( @event.include?('Date') ).to be false
|
84
136
|
end
|
85
137
|
end
|
86
|
-
end
|
87
138
|
|
88
|
-
|
89
|
-
|
90
|
-
|
91
|
-
|
92
|
-
"user" => "#{user}", "password" => "#{password}"}
|
139
|
+
context "mail headers (not lower-cased)" do
|
140
|
+
let(:config) { super().merge("lowercase_headers" => false) }
|
141
|
+
|
142
|
+
before { @event = input.parse_mail(mail) }
|
93
143
|
|
94
|
-
|
95
|
-
|
96
|
-
|
97
|
-
|
144
|
+
it "sets all header fields" do
|
145
|
+
if ecs_compatibility?
|
146
|
+
expect( @event.get("[@metadata][input][imap][headers][X-Spam-Category]") ).to eql 'LEGIT'
|
147
|
+
expect( @event.get("[@metadata][input][imap][headers][X-AES-Category]") ).to eql 'LEGIT'
|
148
|
+
expect( @event.get("[@metadata][input][imap][headers][X-Bot-ID]") ).to eql '111'
|
149
|
+
['Spam-Stopper-Id', 'Spam-Stopper-v2', 'X-MimeOLE', 'Message-ID', 'X-Priority'].each do |name|
|
150
|
+
expect( @event.include?("[@metadata][input][imap][headers][#{name}]") ).to be true
|
151
|
+
end
|
152
|
+
expect( @event.get("[@metadata][input][imap][headers][From]") ).to eql 'me@example.com'
|
153
|
+
expect( @event.get("[@metadata][input][imap][headers][To]") ).to eql 'you@example.com'
|
154
|
+
expect( @event.get("[@metadata][input][imap][headers][Subject]") ).to eql 'logstash imap input test'
|
155
|
+
else
|
156
|
+
expect( @event.get("X-Spam-Category") ).to eql 'LEGIT'
|
157
|
+
expect( @event.get("X-AES-Category") ).to eql 'LEGIT'
|
158
|
+
expect( @event.get("X-Bot-ID") ).to eql '111'
|
159
|
+
['Spam-Stopper-Id', 'Spam-Stopper-v2', 'X-MimeOLE', 'Message-ID', 'X-Priority'].each do |name|
|
160
|
+
expect( @event.include?(name) ).to be true
|
161
|
+
end
|
162
|
+
expect( @event.get("From") ).to eql 'me@example.com'
|
163
|
+
expect( @event.get("To") ).to eql 'you@example.com'
|
164
|
+
expect( @event.get("Subject") ).to eql 'logstash imap input test'
|
165
|
+
end
|
166
|
+
end
|
167
|
+
|
168
|
+
it 'does include the date header' do
|
169
|
+
expect( @event.include?('Date') ).to be true unless ecs_compatibility?
|
170
|
+
end
|
98
171
|
end
|
99
|
-
end
|
100
172
|
|
101
|
-
|
102
|
-
|
103
|
-
|
104
|
-
|
173
|
+
context "headers_target => ''" do
|
174
|
+
let(:config) { super().merge("headers_target" => '') }
|
175
|
+
|
176
|
+
before { @event = input.parse_mail(mail) }
|
105
177
|
|
106
|
-
|
107
|
-
|
178
|
+
it "does not set any header fields" do
|
179
|
+
['From', 'To', 'Subject', 'subject', 'Date', 'date'].each do |name|
|
180
|
+
expect( @event.include?(name) ).to be false # legacy
|
181
|
+
expect( @event.include?("[@metadata][input][imap][headers][#{name}]") ).to be false # ecs
|
182
|
+
end
|
183
|
+
end
|
184
|
+
end
|
108
185
|
|
109
|
-
|
110
|
-
|
111
|
-
|
112
|
-
|
186
|
+
context "when subject is in RFC 2047 encoded-word format" do
|
187
|
+
before do
|
188
|
+
mail.subject = "=?iso-8859-1?Q?foo_:_bar?="
|
189
|
+
end
|
190
|
+
|
191
|
+
it "should be decoded" do
|
192
|
+
event = input.parse_mail(mail)
|
193
|
+
if ecs_compatibility?
|
194
|
+
expect( event.get("[@metadata][input][imap][headers][subject]") ).to eql "foo : bar"
|
195
|
+
else
|
196
|
+
expect( event.get("subject") ).to eql "foo : bar"
|
197
|
+
end
|
198
|
+
end
|
113
199
|
end
|
114
200
|
|
115
|
-
|
116
|
-
|
117
|
-
|
118
|
-
|
201
|
+
context "with multiple values for same header" do
|
202
|
+
it "should add 2 values as array in event" do
|
203
|
+
mail.received = "test1"
|
204
|
+
mail.received = "test2"
|
119
205
|
|
120
|
-
|
121
|
-
|
206
|
+
event = input.parse_mail(mail)
|
207
|
+
expected_value = ["test1", "test2"]
|
208
|
+
if ecs_compatibility?
|
209
|
+
expect( event.get("[@metadata][input][imap][headers][received]") ).to eql expected_value
|
210
|
+
else
|
211
|
+
expect( event.get("received") ).to eql expected_value
|
212
|
+
end
|
213
|
+
end
|
214
|
+
|
215
|
+
it "should add more than 2 values as array in event" do
|
216
|
+
mail.received = "test1"
|
217
|
+
mail.received = "test2"
|
218
|
+
mail.received = "test3"
|
122
219
|
|
123
|
-
|
124
|
-
|
125
|
-
|
126
|
-
|
220
|
+
event = input.parse_mail(mail)
|
221
|
+
expected_value = ["test1", "test2", "test3"]
|
222
|
+
if ecs_compatibility?
|
223
|
+
expect( event.get("[@metadata][input][imap][headers][received]") ).to eql expected_value
|
224
|
+
else
|
225
|
+
expect( event.get("received") ).to eql expected_value
|
226
|
+
end
|
227
|
+
end
|
127
228
|
end
|
128
|
-
end
|
129
229
|
|
130
|
-
|
131
|
-
|
132
|
-
|
133
|
-
config = {"type" => "imap", "host" => "localhost",
|
134
|
-
"user" => "#{user}", "password" => "#{password}"}
|
230
|
+
context "when a header field is nil" do
|
231
|
+
it "should parse mail" do
|
232
|
+
mail.header['X-Custom-Header'] = nil
|
135
233
|
|
136
|
-
|
137
|
-
|
138
|
-
|
139
|
-
insist { event.get("message") } == msg_text
|
234
|
+
event = input.parse_mail(mail)
|
235
|
+
expect( event.get("message") ).to eql msg_text
|
236
|
+
end
|
140
237
|
end
|
141
|
-
end
|
142
238
|
|
143
|
-
|
144
|
-
|
145
|
-
|
146
|
-
|
147
|
-
|
148
|
-
|
149
|
-
|
150
|
-
|
151
|
-
|
152
|
-
|
153
|
-
{"filename"=>"image.png"},
|
154
|
-
{"filename"=>"unencoded.data"}
|
155
|
-
]
|
239
|
+
context "attachments" do
|
240
|
+
it "should extract filenames" do
|
241
|
+
event = input.parse_mail(mail)
|
242
|
+
target = ecs_compatibility? ? '[@metadata][input][imap][attachments]' : 'attachments'
|
243
|
+
expect( event.get(target) ).to eql [
|
244
|
+
{"filename"=>"some.html"},
|
245
|
+
{"filename"=>"image.png"},
|
246
|
+
{"filename"=>"unencoded.data"}
|
247
|
+
]
|
248
|
+
end
|
156
249
|
end
|
157
250
|
|
158
|
-
|
159
|
-
config
|
160
|
-
"user" => "#{user}", "password" => "#{password}",
|
161
|
-
"save_attachments" => true}
|
251
|
+
context "with attachments saving" do
|
252
|
+
let(:config) { super().merge("save_attachments" => true) }
|
162
253
|
|
163
|
-
|
164
|
-
|
165
|
-
|
166
|
-
|
167
|
-
|
168
|
-
|
169
|
-
|
170
|
-
|
254
|
+
it "should extract the encoded content" do
|
255
|
+
event = input.parse_mail(mail)
|
256
|
+
target = ecs_compatibility? ? '[@metadata][input][imap][attachments]' : 'attachments'
|
257
|
+
expect( event.get(target) ).to eql [
|
258
|
+
{"data"=> Base64.encode64(msg_html).encode(crlf_newline: true), "filename"=>"some.html"},
|
259
|
+
{"data"=> Base64.encode64(msg_binary).encode(crlf_newline: true), "filename"=>"image.png"},
|
260
|
+
{"data"=> msg_unencoded, "filename"=>"unencoded.data"}
|
261
|
+
]
|
171
262
|
end
|
263
|
+
end
|
264
|
+
|
172
265
|
end
|
266
|
+
|
173
267
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-input-imap
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 3.1
|
4
|
+
version: 3.2.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2023-10-03 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|
@@ -33,80 +33,80 @@ dependencies:
|
|
33
33
|
- !ruby/object:Gem::Dependency
|
34
34
|
requirement: !ruby/object:Gem::Requirement
|
35
35
|
requirements:
|
36
|
-
- - "
|
36
|
+
- - "~>"
|
37
37
|
- !ruby/object:Gem::Version
|
38
|
-
version: '
|
39
|
-
name: logstash-
|
38
|
+
version: '1.3'
|
39
|
+
name: logstash-mixin-ecs_compatibility_support
|
40
40
|
prerelease: false
|
41
41
|
type: :runtime
|
42
42
|
version_requirements: !ruby/object:Gem::Requirement
|
43
43
|
requirements:
|
44
|
-
- - "
|
44
|
+
- - "~>"
|
45
45
|
- !ruby/object:Gem::Version
|
46
|
-
version: '
|
46
|
+
version: '1.3'
|
47
47
|
- !ruby/object:Gem::Dependency
|
48
48
|
requirement: !ruby/object:Gem::Requirement
|
49
49
|
requirements:
|
50
50
|
- - "~>"
|
51
51
|
- !ruby/object:Gem::Version
|
52
|
-
version:
|
53
|
-
name:
|
52
|
+
version: '1.0'
|
53
|
+
name: logstash-mixin-validator_support
|
54
54
|
prerelease: false
|
55
55
|
type: :runtime
|
56
56
|
version_requirements: !ruby/object:Gem::Requirement
|
57
57
|
requirements:
|
58
58
|
- - "~>"
|
59
59
|
- !ruby/object:Gem::Version
|
60
|
-
version:
|
60
|
+
version: '1.0'
|
61
61
|
- !ruby/object:Gem::Dependency
|
62
62
|
requirement: !ruby/object:Gem::Requirement
|
63
63
|
requirements:
|
64
|
-
- -
|
64
|
+
- - ">="
|
65
65
|
- !ruby/object:Gem::Version
|
66
|
-
version:
|
67
|
-
name:
|
66
|
+
version: '0'
|
67
|
+
name: logstash-codec-plain
|
68
68
|
prerelease: false
|
69
69
|
type: :runtime
|
70
70
|
version_requirements: !ruby/object:Gem::Requirement
|
71
71
|
requirements:
|
72
|
-
- -
|
72
|
+
- - ">="
|
73
73
|
- !ruby/object:Gem::Version
|
74
|
-
version:
|
74
|
+
version: '0'
|
75
75
|
- !ruby/object:Gem::Dependency
|
76
76
|
requirement: !ruby/object:Gem::Requirement
|
77
77
|
requirements:
|
78
78
|
- - "~>"
|
79
79
|
- !ruby/object:Gem::Version
|
80
|
-
version:
|
81
|
-
name:
|
80
|
+
version: '2.8'
|
81
|
+
name: mail
|
82
82
|
prerelease: false
|
83
83
|
type: :runtime
|
84
84
|
version_requirements: !ruby/object:Gem::Requirement
|
85
85
|
requirements:
|
86
86
|
- - "~>"
|
87
87
|
- !ruby/object:Gem::Version
|
88
|
-
version:
|
88
|
+
version: '2.8'
|
89
89
|
- !ruby/object:Gem::Dependency
|
90
90
|
requirement: !ruby/object:Gem::Requirement
|
91
91
|
requirements:
|
92
|
-
- - "
|
92
|
+
- - "~>"
|
93
93
|
- !ruby/object:Gem::Version
|
94
|
-
version:
|
95
|
-
name:
|
94
|
+
version: 0.0.22
|
95
|
+
name: stud
|
96
96
|
prerelease: false
|
97
|
-
type: :
|
97
|
+
type: :runtime
|
98
98
|
version_requirements: !ruby/object:Gem::Requirement
|
99
99
|
requirements:
|
100
|
-
- - "
|
100
|
+
- - "~>"
|
101
101
|
- !ruby/object:Gem::Version
|
102
|
-
version:
|
102
|
+
version: 0.0.22
|
103
103
|
- !ruby/object:Gem::Dependency
|
104
104
|
requirement: !ruby/object:Gem::Requirement
|
105
105
|
requirements:
|
106
106
|
- - ">="
|
107
107
|
- !ruby/object:Gem::Version
|
108
108
|
version: '0'
|
109
|
-
name:
|
109
|
+
name: logstash-devutils
|
110
110
|
prerelease: false
|
111
111
|
type: :development
|
112
112
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -132,7 +132,7 @@ files:
|
|
132
132
|
- lib/logstash/inputs/imap.rb
|
133
133
|
- logstash-input-imap.gemspec
|
134
134
|
- spec/inputs/imap_spec.rb
|
135
|
-
homepage:
|
135
|
+
homepage: https://www.elastic.co/logstash
|
136
136
|
licenses:
|
137
137
|
- Apache License (2.0)
|
138
138
|
metadata:
|
@@ -153,8 +153,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
153
153
|
- !ruby/object:Gem::Version
|
154
154
|
version: '0'
|
155
155
|
requirements: []
|
156
|
-
|
157
|
-
rubygems_version: 2.6.13
|
156
|
+
rubygems_version: 3.2.33
|
158
157
|
signing_key:
|
159
158
|
specification_version: 4
|
160
159
|
summary: Reads mail from an IMAP server
|