logstash-input-syslog 2.0.5 → 3.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +2 -0
- data/Gemfile +3 -1
- data/LICENSE +1 -1
- data/README.md +12 -3
- data/lib/logstash/inputs/syslog.rb +15 -15
- data/logstash-input-syslog.gemspec +3 -3
- data/spec/inputs/syslog_spec.rb +11 -11
- metadata +61 -59
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: ea70c51553600b7e2cef7b04629fd640d475a8e0
|
4
|
+
data.tar.gz: a3f080382a3b4325ac3733912eddb2df02683b53
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: dcbec20bdf587e69259a138e2385dea1066ae744726cff25527e6839131b6ade3595ff0fe1035914e6e9f37555919f2bbd436dff7448bb5e1a3f837b209879ef
|
7
|
+
data.tar.gz: 12baf725da37045110aef3ea358e1d3300c676040e0537451b001c469af4890b1a3006a8c7247493a6b4aca27c7721e41517d90292d914a6e994e28b301eafc1
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,5 @@
|
|
1
|
+
## 3.0.0
|
2
|
+
- Update the plugin to the version 2.0 of the plugin api, this change is required for Logstash 5.0 compatibility. See https://github.com/elastic/logstash/issues/5141
|
1
3
|
# 2.0.5
|
2
4
|
- Temporary specs fix, see https://github.com/logstash-plugins/logstash-input-syslog/pull/25
|
3
5
|
# 2.0.4
|
data/Gemfile
CHANGED
data/LICENSE
CHANGED
data/README.md
CHANGED
@@ -1,7 +1,6 @@
|
|
1
1
|
# Logstash Plugin
|
2
2
|
|
3
|
-
[![Build
|
4
|
-
Status](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Inputs/job/logstash-plugin-input-syslog-unit/badge/icon)](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Inputs/job/logstash-plugin-input-syslog-unit/)
|
3
|
+
[![Travis Build Status](https://travis-ci.org/logstash-plugins/logstash-input-syslog.svg)](https://travis-ci.org/logstash-plugins/logstash-input-syslog)
|
5
4
|
|
6
5
|
This is a plugin for [Logstash](https://github.com/elastic/logstash).
|
7
6
|
|
@@ -56,7 +55,12 @@ gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
|
|
56
55
|
```
|
57
56
|
- Install plugin
|
58
57
|
```sh
|
58
|
+
# Logstash 2.3 and higher
|
59
|
+
bin/logstash-plugin install --no-verify
|
60
|
+
|
61
|
+
# Prior to Logstash 2.3
|
59
62
|
bin/plugin install --no-verify
|
63
|
+
|
60
64
|
```
|
61
65
|
- Run Logstash with your plugin
|
62
66
|
```sh
|
@@ -74,7 +78,12 @@ gem build logstash-filter-awesome.gemspec
|
|
74
78
|
```
|
75
79
|
- Install the plugin from the Logstash home
|
76
80
|
```sh
|
77
|
-
|
81
|
+
# Logstash 2.3 and higher
|
82
|
+
bin/logstash-plugin install --no-verify
|
83
|
+
|
84
|
+
# Prior to Logstash 2.3
|
85
|
+
bin/plugin install --no-verify
|
86
|
+
|
78
87
|
```
|
79
88
|
- Start Logstash and proceed to test the plugin
|
80
89
|
|
@@ -182,7 +182,7 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
182
182
|
def decode(host, output_queue, data)
|
183
183
|
@codec.decode(data) do |event|
|
184
184
|
decorate(event)
|
185
|
-
event
|
185
|
+
event.set("host", host)
|
186
186
|
syslog_relay(event)
|
187
187
|
output_queue << event
|
188
188
|
end
|
@@ -225,40 +225,40 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
225
225
|
def syslog_relay(event)
|
226
226
|
@grok_filter.filter(event)
|
227
227
|
|
228
|
-
if event
|
228
|
+
if event.get("tags").nil? || !event.get("tags").include?(@grok_filter.tag_on_failure)
|
229
229
|
# Per RFC3164, priority = (facility * 8) + severity
|
230
230
|
# = (facility << 3) & (severity)
|
231
|
-
priority = event
|
231
|
+
priority = event.get("priority").to_i rescue 13
|
232
232
|
severity = priority & 7 # 7 is 111 (3 bits)
|
233
233
|
facility = priority >> 3
|
234
|
-
event
|
235
|
-
event
|
236
|
-
event
|
234
|
+
event.set("priority", priority)
|
235
|
+
event.set("severity", severity)
|
236
|
+
event.set("facility", facility)
|
237
237
|
|
238
|
-
event
|
238
|
+
event.set("timestamp", event.get("timestamp8601")) if event.include?("timestamp8601")
|
239
239
|
@date_filter.filter(event)
|
240
240
|
else
|
241
|
-
@logger.info? && @logger.info("NOT SYSLOG", :message => event
|
241
|
+
@logger.info? && @logger.info("NOT SYSLOG", :message => event.get("message"))
|
242
242
|
|
243
243
|
# RFC3164 says unknown messages get pri=13
|
244
244
|
priority = 13
|
245
|
-
event
|
246
|
-
event
|
247
|
-
event
|
245
|
+
event.set("priority", 13)
|
246
|
+
event.set("severity", 5) # 13 & 7 == 5
|
247
|
+
event.set("facility", 1) # 13 >> 3 == 1
|
248
248
|
end
|
249
249
|
|
250
250
|
# Apply severity and facility metadata if
|
251
251
|
# use_labels => true
|
252
252
|
if @use_labels
|
253
|
-
facility_number = event
|
254
|
-
severity_number = event
|
253
|
+
facility_number = event.get("facility")
|
254
|
+
severity_number = event.get("severity")
|
255
255
|
|
256
256
|
if @facility_labels[facility_number]
|
257
|
-
event
|
257
|
+
event.set("facility_label", @facility_labels[facility_number])
|
258
258
|
end
|
259
259
|
|
260
260
|
if @severity_labels[severity_number]
|
261
|
-
event
|
261
|
+
event.set("severity_label", @severity_labels[severity_number])
|
262
262
|
end
|
263
263
|
end
|
264
264
|
end # def syslog_relay
|
@@ -1,10 +1,10 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-input-syslog'
|
4
|
-
s.version = '
|
4
|
+
s.version = '3.0.0'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "Read syslog messages as events over the network."
|
7
|
-
s.description = "This gem is a
|
7
|
+
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
8
8
|
s.authors = ["Elastic"]
|
9
9
|
s.email = 'info@elastic.co'
|
10
10
|
s.homepage = "http://www.elastic.co/guide/en/logstash/current/index.html"
|
@@ -20,7 +20,7 @@ Gem::Specification.new do |s|
|
|
20
20
|
s.metadata = { "logstash_plugin" => "true", "logstash_group" => "input" }
|
21
21
|
|
22
22
|
# Gem dependencies
|
23
|
-
s.add_runtime_dependency "logstash-core-plugin-api", "~>
|
23
|
+
s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
|
24
24
|
|
25
25
|
s.add_runtime_dependency 'concurrent-ruby'
|
26
26
|
s.add_runtime_dependency 'thread_safe'
|
data/spec/inputs/syslog_spec.rb
CHANGED
@@ -53,9 +53,9 @@ describe LogStash::Inputs::Syslog do
|
|
53
53
|
|
54
54
|
insist { events.length } == event_count
|
55
55
|
events.each do |event|
|
56
|
-
insist { event
|
57
|
-
insist { event
|
58
|
-
insist { event
|
56
|
+
insist { event.get("priority") } == 164
|
57
|
+
insist { event.get("severity") } == 4
|
58
|
+
insist { event.get("facility") } == 20
|
59
59
|
end
|
60
60
|
end
|
61
61
|
|
@@ -83,7 +83,7 @@ describe LogStash::Inputs::Syslog do
|
|
83
83
|
|
84
84
|
insist { events.length } == event_count
|
85
85
|
event_count.times do |i|
|
86
|
-
insist { events[i]
|
86
|
+
insist { events[i].get("tags") } == ["_grokparsefailure_sysloginput"]
|
87
87
|
end
|
88
88
|
end
|
89
89
|
|
@@ -114,7 +114,7 @@ describe LogStash::Inputs::Syslog do
|
|
114
114
|
|
115
115
|
insist { events.length } == event_count
|
116
116
|
events.each do |event|
|
117
|
-
insist { event
|
117
|
+
insist { event.get("@timestamp").to_iso8601 } == "#{Time.now.year}-10-26T15:19:25.000Z"
|
118
118
|
end
|
119
119
|
end
|
120
120
|
|
@@ -139,7 +139,7 @@ describe LogStash::Inputs::Syslog do
|
|
139
139
|
end
|
140
140
|
|
141
141
|
# chances platform timezone is not UTC so ignore the hours
|
142
|
-
insist { event
|
142
|
+
insist { event.get("@timestamp").to_iso8601 } =~ /#{Time.now.year}-10-26T\d\d:19:25.000Z/
|
143
143
|
end
|
144
144
|
|
145
145
|
it "should support non UTC timezone" do
|
@@ -150,7 +150,7 @@ describe LogStash::Inputs::Syslog do
|
|
150
150
|
|
151
151
|
syslog_event = LogStash::Event.new({ "message" => "<164>Oct 26 15:19:25 1.2.3.4 %ASA-4-106023: Deny udp src DRAC:10.1.2.3/43434" })
|
152
152
|
input.syslog_relay(syslog_event)
|
153
|
-
insist { syslog_event
|
153
|
+
insist { syslog_event.get("@timestamp").to_iso8601 } == "#{Time.now.year}-10-26T20:19:25.000Z"
|
154
154
|
|
155
155
|
input.close
|
156
156
|
end
|
@@ -162,13 +162,13 @@ describe LogStash::Inputs::Syslog do
|
|
162
162
|
# event which is not syslog should have a new tag
|
163
163
|
event = LogStash::Event.new({ "message" => "hello world, this is not syslog RFC3164" })
|
164
164
|
input.syslog_relay(event)
|
165
|
-
insist { event
|
165
|
+
insist { event.get("tags") } == ["_grokparsefailure_sysloginput"]
|
166
166
|
|
167
167
|
syslog_event = LogStash::Event.new({ "message" => "<164>Oct 26 15:19:25 1.2.3.4 %ASA-4-106023: Deny udp src DRAC:10.1.2.3/43434" })
|
168
168
|
input.syslog_relay(syslog_event)
|
169
|
-
insist { syslog_event
|
170
|
-
insist { syslog_event
|
171
|
-
insist { syslog_event
|
169
|
+
insist { syslog_event.get("priority") } == 164
|
170
|
+
insist { syslog_event.get("severity") } == 4
|
171
|
+
insist { syslog_event.get("tags") } == nil
|
172
172
|
|
173
173
|
input.close
|
174
174
|
end
|
metadata
CHANGED
@@ -1,134 +1,136 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-input-syslog
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 3.0.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
|
-
autorequire:
|
8
|
+
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2016-
|
11
|
+
date: 2016-05-06 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: logstash-core-plugin-api
|
15
|
-
version_requirements: !ruby/object:Gem::Requirement
|
16
|
-
requirements:
|
17
|
-
- - ~>
|
18
|
-
- !ruby/object:Gem::Version
|
19
|
-
version: '1.0'
|
20
15
|
requirement: !ruby/object:Gem::Requirement
|
21
16
|
requirements:
|
22
|
-
- - ~>
|
17
|
+
- - "~>"
|
23
18
|
- !ruby/object:Gem::Version
|
24
|
-
version: '
|
25
|
-
prerelease: false
|
19
|
+
version: '2.0'
|
26
20
|
type: :runtime
|
27
|
-
|
28
|
-
name: concurrent-ruby
|
21
|
+
prerelease: false
|
29
22
|
version_requirements: !ruby/object:Gem::Requirement
|
30
23
|
requirements:
|
31
|
-
- -
|
24
|
+
- - "~>"
|
32
25
|
- !ruby/object:Gem::Version
|
33
|
-
version: '0'
|
26
|
+
version: '2.0'
|
27
|
+
- !ruby/object:Gem::Dependency
|
28
|
+
name: concurrent-ruby
|
34
29
|
requirement: !ruby/object:Gem::Requirement
|
35
30
|
requirements:
|
36
|
-
- -
|
31
|
+
- - ">="
|
37
32
|
- !ruby/object:Gem::Version
|
38
33
|
version: '0'
|
39
|
-
prerelease: false
|
40
34
|
type: :runtime
|
41
|
-
|
42
|
-
name: thread_safe
|
35
|
+
prerelease: false
|
43
36
|
version_requirements: !ruby/object:Gem::Requirement
|
44
37
|
requirements:
|
45
|
-
- -
|
38
|
+
- - ">="
|
46
39
|
- !ruby/object:Gem::Version
|
47
40
|
version: '0'
|
41
|
+
- !ruby/object:Gem::Dependency
|
42
|
+
name: thread_safe
|
48
43
|
requirement: !ruby/object:Gem::Requirement
|
49
44
|
requirements:
|
50
|
-
- -
|
45
|
+
- - ">="
|
51
46
|
- !ruby/object:Gem::Version
|
52
47
|
version: '0'
|
53
|
-
prerelease: false
|
54
48
|
type: :runtime
|
49
|
+
prerelease: false
|
50
|
+
version_requirements: !ruby/object:Gem::Requirement
|
51
|
+
requirements:
|
52
|
+
- - ">="
|
53
|
+
- !ruby/object:Gem::Version
|
54
|
+
version: '0'
|
55
55
|
- !ruby/object:Gem::Dependency
|
56
56
|
name: stud
|
57
|
-
|
57
|
+
requirement: !ruby/object:Gem::Requirement
|
58
58
|
requirements:
|
59
|
-
- -
|
59
|
+
- - ">="
|
60
60
|
- !ruby/object:Gem::Version
|
61
61
|
version: 0.0.22
|
62
|
-
- - <
|
62
|
+
- - "<"
|
63
63
|
- !ruby/object:Gem::Version
|
64
64
|
version: 0.1.0
|
65
|
-
|
65
|
+
type: :runtime
|
66
|
+
prerelease: false
|
67
|
+
version_requirements: !ruby/object:Gem::Requirement
|
66
68
|
requirements:
|
67
|
-
- -
|
69
|
+
- - ">="
|
68
70
|
- !ruby/object:Gem::Version
|
69
71
|
version: 0.0.22
|
70
|
-
- - <
|
72
|
+
- - "<"
|
71
73
|
- !ruby/object:Gem::Version
|
72
74
|
version: 0.1.0
|
73
|
-
prerelease: false
|
74
|
-
type: :runtime
|
75
75
|
- !ruby/object:Gem::Dependency
|
76
76
|
name: logstash-codec-plain
|
77
|
-
version_requirements: !ruby/object:Gem::Requirement
|
78
|
-
requirements:
|
79
|
-
- - '>='
|
80
|
-
- !ruby/object:Gem::Version
|
81
|
-
version: '0'
|
82
77
|
requirement: !ruby/object:Gem::Requirement
|
83
78
|
requirements:
|
84
|
-
- -
|
79
|
+
- - ">="
|
85
80
|
- !ruby/object:Gem::Version
|
86
81
|
version: '0'
|
87
|
-
prerelease: false
|
88
82
|
type: :runtime
|
89
|
-
|
90
|
-
name: logstash-filter-grok
|
83
|
+
prerelease: false
|
91
84
|
version_requirements: !ruby/object:Gem::Requirement
|
92
85
|
requirements:
|
93
|
-
- -
|
86
|
+
- - ">="
|
94
87
|
- !ruby/object:Gem::Version
|
95
88
|
version: '0'
|
89
|
+
- !ruby/object:Gem::Dependency
|
90
|
+
name: logstash-filter-grok
|
96
91
|
requirement: !ruby/object:Gem::Requirement
|
97
92
|
requirements:
|
98
|
-
- -
|
93
|
+
- - ">="
|
99
94
|
- !ruby/object:Gem::Version
|
100
95
|
version: '0'
|
101
|
-
prerelease: false
|
102
96
|
type: :runtime
|
103
|
-
|
104
|
-
name: logstash-filter-date
|
97
|
+
prerelease: false
|
105
98
|
version_requirements: !ruby/object:Gem::Requirement
|
106
99
|
requirements:
|
107
|
-
- -
|
100
|
+
- - ">="
|
108
101
|
- !ruby/object:Gem::Version
|
109
102
|
version: '0'
|
103
|
+
- !ruby/object:Gem::Dependency
|
104
|
+
name: logstash-filter-date
|
110
105
|
requirement: !ruby/object:Gem::Requirement
|
111
106
|
requirements:
|
112
|
-
- -
|
107
|
+
- - ">="
|
113
108
|
- !ruby/object:Gem::Version
|
114
109
|
version: '0'
|
115
|
-
prerelease: false
|
116
110
|
type: :runtime
|
117
|
-
|
118
|
-
name: logstash-devutils
|
111
|
+
prerelease: false
|
119
112
|
version_requirements: !ruby/object:Gem::Requirement
|
120
113
|
requirements:
|
121
|
-
- -
|
114
|
+
- - ">="
|
122
115
|
- !ruby/object:Gem::Version
|
123
116
|
version: '0'
|
117
|
+
- !ruby/object:Gem::Dependency
|
118
|
+
name: logstash-devutils
|
124
119
|
requirement: !ruby/object:Gem::Requirement
|
125
120
|
requirements:
|
126
|
-
- -
|
121
|
+
- - ">="
|
127
122
|
- !ruby/object:Gem::Version
|
128
123
|
version: '0'
|
129
|
-
prerelease: false
|
130
124
|
type: :development
|
131
|
-
|
125
|
+
prerelease: false
|
126
|
+
version_requirements: !ruby/object:Gem::Requirement
|
127
|
+
requirements:
|
128
|
+
- - ">="
|
129
|
+
- !ruby/object:Gem::Version
|
130
|
+
version: '0'
|
131
|
+
description: This gem is a Logstash plugin required to be installed on top of the
|
132
|
+
Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
|
133
|
+
gem is not a stand-alone program
|
132
134
|
email: info@elastic.co
|
133
135
|
executables: []
|
134
136
|
extensions: []
|
@@ -149,24 +151,24 @@ licenses:
|
|
149
151
|
metadata:
|
150
152
|
logstash_plugin: 'true'
|
151
153
|
logstash_group: input
|
152
|
-
post_install_message:
|
154
|
+
post_install_message:
|
153
155
|
rdoc_options: []
|
154
156
|
require_paths:
|
155
157
|
- lib
|
156
158
|
required_ruby_version: !ruby/object:Gem::Requirement
|
157
159
|
requirements:
|
158
|
-
- -
|
160
|
+
- - ">="
|
159
161
|
- !ruby/object:Gem::Version
|
160
162
|
version: '0'
|
161
163
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
162
164
|
requirements:
|
163
|
-
- -
|
165
|
+
- - ">="
|
164
166
|
- !ruby/object:Gem::Version
|
165
167
|
version: '0'
|
166
168
|
requirements: []
|
167
|
-
rubyforge_project:
|
168
|
-
rubygems_version: 2.
|
169
|
-
signing_key:
|
169
|
+
rubyforge_project:
|
170
|
+
rubygems_version: 2.5.1
|
171
|
+
signing_key:
|
170
172
|
specification_version: 4
|
171
173
|
summary: Read syslog messages as events over the network.
|
172
174
|
test_files:
|