logstash-input-syslog 2.0.5 → 3.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +2 -0
- data/Gemfile +3 -1
- data/LICENSE +1 -1
- data/README.md +12 -3
- data/lib/logstash/inputs/syslog.rb +15 -15
- data/logstash-input-syslog.gemspec +3 -3
- data/spec/inputs/syslog_spec.rb +11 -11
- metadata +61 -59
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: ea70c51553600b7e2cef7b04629fd640d475a8e0
|
4
|
+
data.tar.gz: a3f080382a3b4325ac3733912eddb2df02683b53
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: dcbec20bdf587e69259a138e2385dea1066ae744726cff25527e6839131b6ade3595ff0fe1035914e6e9f37555919f2bbd436dff7448bb5e1a3f837b209879ef
|
7
|
+
data.tar.gz: 12baf725da37045110aef3ea358e1d3300c676040e0537451b001c469af4890b1a3006a8c7247493a6b4aca27c7721e41517d90292d914a6e994e28b301eafc1
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,5 @@
|
|
1
|
+
## 3.0.0
|
2
|
+
- Update the plugin to the version 2.0 of the plugin api, this change is required for Logstash 5.0 compatibility. See https://github.com/elastic/logstash/issues/5141
|
1
3
|
# 2.0.5
|
2
4
|
- Temporary specs fix, see https://github.com/logstash-plugins/logstash-input-syslog/pull/25
|
3
5
|
# 2.0.4
|
data/Gemfile
CHANGED
data/LICENSE
CHANGED
data/README.md
CHANGED
@@ -1,7 +1,6 @@
|
|
1
1
|
# Logstash Plugin
|
2
2
|
|
3
|
-
[](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Inputs/job/logstash-plugin-input-syslog-unit/)
|
3
|
+
[](https://travis-ci.org/logstash-plugins/logstash-input-syslog)
|
5
4
|
|
6
5
|
This is a plugin for [Logstash](https://github.com/elastic/logstash).
|
7
6
|
|
@@ -56,7 +55,12 @@ gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
|
|
56
55
|
```
|
57
56
|
- Install plugin
|
58
57
|
```sh
|
58
|
+
# Logstash 2.3 and higher
|
59
|
+
bin/logstash-plugin install --no-verify
|
60
|
+
|
61
|
+
# Prior to Logstash 2.3
|
59
62
|
bin/plugin install --no-verify
|
63
|
+
|
60
64
|
```
|
61
65
|
- Run Logstash with your plugin
|
62
66
|
```sh
|
@@ -74,7 +78,12 @@ gem build logstash-filter-awesome.gemspec
|
|
74
78
|
```
|
75
79
|
- Install the plugin from the Logstash home
|
76
80
|
```sh
|
77
|
-
|
81
|
+
# Logstash 2.3 and higher
|
82
|
+
bin/logstash-plugin install --no-verify
|
83
|
+
|
84
|
+
# Prior to Logstash 2.3
|
85
|
+
bin/plugin install --no-verify
|
86
|
+
|
78
87
|
```
|
79
88
|
- Start Logstash and proceed to test the plugin
|
80
89
|
|
@@ -182,7 +182,7 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
182
182
|
def decode(host, output_queue, data)
|
183
183
|
@codec.decode(data) do |event|
|
184
184
|
decorate(event)
|
185
|
-
event
|
185
|
+
event.set("host", host)
|
186
186
|
syslog_relay(event)
|
187
187
|
output_queue << event
|
188
188
|
end
|
@@ -225,40 +225,40 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
225
225
|
def syslog_relay(event)
|
226
226
|
@grok_filter.filter(event)
|
227
227
|
|
228
|
-
if event
|
228
|
+
if event.get("tags").nil? || !event.get("tags").include?(@grok_filter.tag_on_failure)
|
229
229
|
# Per RFC3164, priority = (facility * 8) + severity
|
230
230
|
# = (facility << 3) & (severity)
|
231
|
-
priority = event
|
231
|
+
priority = event.get("priority").to_i rescue 13
|
232
232
|
severity = priority & 7 # 7 is 111 (3 bits)
|
233
233
|
facility = priority >> 3
|
234
|
-
event
|
235
|
-
event
|
236
|
-
event
|
234
|
+
event.set("priority", priority)
|
235
|
+
event.set("severity", severity)
|
236
|
+
event.set("facility", facility)
|
237
237
|
|
238
|
-
event
|
238
|
+
event.set("timestamp", event.get("timestamp8601")) if event.include?("timestamp8601")
|
239
239
|
@date_filter.filter(event)
|
240
240
|
else
|
241
|
-
@logger.info? && @logger.info("NOT SYSLOG", :message => event
|
241
|
+
@logger.info? && @logger.info("NOT SYSLOG", :message => event.get("message"))
|
242
242
|
|
243
243
|
# RFC3164 says unknown messages get pri=13
|
244
244
|
priority = 13
|
245
|
-
event
|
246
|
-
event
|
247
|
-
event
|
245
|
+
event.set("priority", 13)
|
246
|
+
event.set("severity", 5) # 13 & 7 == 5
|
247
|
+
event.set("facility", 1) # 13 >> 3 == 1
|
248
248
|
end
|
249
249
|
|
250
250
|
# Apply severity and facility metadata if
|
251
251
|
# use_labels => true
|
252
252
|
if @use_labels
|
253
|
-
facility_number = event
|
254
|
-
severity_number = event
|
253
|
+
facility_number = event.get("facility")
|
254
|
+
severity_number = event.get("severity")
|
255
255
|
|
256
256
|
if @facility_labels[facility_number]
|
257
|
-
event
|
257
|
+
event.set("facility_label", @facility_labels[facility_number])
|
258
258
|
end
|
259
259
|
|
260
260
|
if @severity_labels[severity_number]
|
261
|
-
event
|
261
|
+
event.set("severity_label", @severity_labels[severity_number])
|
262
262
|
end
|
263
263
|
end
|
264
264
|
end # def syslog_relay
|
@@ -1,10 +1,10 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
|
3
3
|
s.name = 'logstash-input-syslog'
|
4
|
-
s.version = '
|
4
|
+
s.version = '3.0.0'
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
6
6
|
s.summary = "Read syslog messages as events over the network."
|
7
|
-
s.description = "This gem is a
|
7
|
+
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
8
8
|
s.authors = ["Elastic"]
|
9
9
|
s.email = 'info@elastic.co'
|
10
10
|
s.homepage = "http://www.elastic.co/guide/en/logstash/current/index.html"
|
@@ -20,7 +20,7 @@ Gem::Specification.new do |s|
|
|
20
20
|
s.metadata = { "logstash_plugin" => "true", "logstash_group" => "input" }
|
21
21
|
|
22
22
|
# Gem dependencies
|
23
|
-
s.add_runtime_dependency "logstash-core-plugin-api", "~>
|
23
|
+
s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
|
24
24
|
|
25
25
|
s.add_runtime_dependency 'concurrent-ruby'
|
26
26
|
s.add_runtime_dependency 'thread_safe'
|
data/spec/inputs/syslog_spec.rb
CHANGED
@@ -53,9 +53,9 @@ describe LogStash::Inputs::Syslog do
|
|
53
53
|
|
54
54
|
insist { events.length } == event_count
|
55
55
|
events.each do |event|
|
56
|
-
insist { event
|
57
|
-
insist { event
|
58
|
-
insist { event
|
56
|
+
insist { event.get("priority") } == 164
|
57
|
+
insist { event.get("severity") } == 4
|
58
|
+
insist { event.get("facility") } == 20
|
59
59
|
end
|
60
60
|
end
|
61
61
|
|
@@ -83,7 +83,7 @@ describe LogStash::Inputs::Syslog do
|
|
83
83
|
|
84
84
|
insist { events.length } == event_count
|
85
85
|
event_count.times do |i|
|
86
|
-
insist { events[i]
|
86
|
+
insist { events[i].get("tags") } == ["_grokparsefailure_sysloginput"]
|
87
87
|
end
|
88
88
|
end
|
89
89
|
|
@@ -114,7 +114,7 @@ describe LogStash::Inputs::Syslog do
|
|
114
114
|
|
115
115
|
insist { events.length } == event_count
|
116
116
|
events.each do |event|
|
117
|
-
insist { event
|
117
|
+
insist { event.get("@timestamp").to_iso8601 } == "#{Time.now.year}-10-26T15:19:25.000Z"
|
118
118
|
end
|
119
119
|
end
|
120
120
|
|
@@ -139,7 +139,7 @@ describe LogStash::Inputs::Syslog do
|
|
139
139
|
end
|
140
140
|
|
141
141
|
# chances platform timezone is not UTC so ignore the hours
|
142
|
-
insist { event
|
142
|
+
insist { event.get("@timestamp").to_iso8601 } =~ /#{Time.now.year}-10-26T\d\d:19:25.000Z/
|
143
143
|
end
|
144
144
|
|
145
145
|
it "should support non UTC timezone" do
|
@@ -150,7 +150,7 @@ describe LogStash::Inputs::Syslog do
|
|
150
150
|
|
151
151
|
syslog_event = LogStash::Event.new({ "message" => "<164>Oct 26 15:19:25 1.2.3.4 %ASA-4-106023: Deny udp src DRAC:10.1.2.3/43434" })
|
152
152
|
input.syslog_relay(syslog_event)
|
153
|
-
insist { syslog_event
|
153
|
+
insist { syslog_event.get("@timestamp").to_iso8601 } == "#{Time.now.year}-10-26T20:19:25.000Z"
|
154
154
|
|
155
155
|
input.close
|
156
156
|
end
|
@@ -162,13 +162,13 @@ describe LogStash::Inputs::Syslog do
|
|
162
162
|
# event which is not syslog should have a new tag
|
163
163
|
event = LogStash::Event.new({ "message" => "hello world, this is not syslog RFC3164" })
|
164
164
|
input.syslog_relay(event)
|
165
|
-
insist { event
|
165
|
+
insist { event.get("tags") } == ["_grokparsefailure_sysloginput"]
|
166
166
|
|
167
167
|
syslog_event = LogStash::Event.new({ "message" => "<164>Oct 26 15:19:25 1.2.3.4 %ASA-4-106023: Deny udp src DRAC:10.1.2.3/43434" })
|
168
168
|
input.syslog_relay(syslog_event)
|
169
|
-
insist { syslog_event
|
170
|
-
insist { syslog_event
|
171
|
-
insist { syslog_event
|
169
|
+
insist { syslog_event.get("priority") } == 164
|
170
|
+
insist { syslog_event.get("severity") } == 4
|
171
|
+
insist { syslog_event.get("tags") } == nil
|
172
172
|
|
173
173
|
input.close
|
174
174
|
end
|
metadata
CHANGED
@@ -1,134 +1,136 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: logstash-input-syslog
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 3.0.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Elastic
|
8
|
-
autorequire:
|
8
|
+
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2016-
|
11
|
+
date: 2016-05-06 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: logstash-core-plugin-api
|
15
|
-
version_requirements: !ruby/object:Gem::Requirement
|
16
|
-
requirements:
|
17
|
-
- - ~>
|
18
|
-
- !ruby/object:Gem::Version
|
19
|
-
version: '1.0'
|
20
15
|
requirement: !ruby/object:Gem::Requirement
|
21
16
|
requirements:
|
22
|
-
- - ~>
|
17
|
+
- - "~>"
|
23
18
|
- !ruby/object:Gem::Version
|
24
|
-
version: '
|
25
|
-
prerelease: false
|
19
|
+
version: '2.0'
|
26
20
|
type: :runtime
|
27
|
-
|
28
|
-
name: concurrent-ruby
|
21
|
+
prerelease: false
|
29
22
|
version_requirements: !ruby/object:Gem::Requirement
|
30
23
|
requirements:
|
31
|
-
- -
|
24
|
+
- - "~>"
|
32
25
|
- !ruby/object:Gem::Version
|
33
|
-
version: '0'
|
26
|
+
version: '2.0'
|
27
|
+
- !ruby/object:Gem::Dependency
|
28
|
+
name: concurrent-ruby
|
34
29
|
requirement: !ruby/object:Gem::Requirement
|
35
30
|
requirements:
|
36
|
-
- -
|
31
|
+
- - ">="
|
37
32
|
- !ruby/object:Gem::Version
|
38
33
|
version: '0'
|
39
|
-
prerelease: false
|
40
34
|
type: :runtime
|
41
|
-
|
42
|
-
name: thread_safe
|
35
|
+
prerelease: false
|
43
36
|
version_requirements: !ruby/object:Gem::Requirement
|
44
37
|
requirements:
|
45
|
-
- -
|
38
|
+
- - ">="
|
46
39
|
- !ruby/object:Gem::Version
|
47
40
|
version: '0'
|
41
|
+
- !ruby/object:Gem::Dependency
|
42
|
+
name: thread_safe
|
48
43
|
requirement: !ruby/object:Gem::Requirement
|
49
44
|
requirements:
|
50
|
-
- -
|
45
|
+
- - ">="
|
51
46
|
- !ruby/object:Gem::Version
|
52
47
|
version: '0'
|
53
|
-
prerelease: false
|
54
48
|
type: :runtime
|
49
|
+
prerelease: false
|
50
|
+
version_requirements: !ruby/object:Gem::Requirement
|
51
|
+
requirements:
|
52
|
+
- - ">="
|
53
|
+
- !ruby/object:Gem::Version
|
54
|
+
version: '0'
|
55
55
|
- !ruby/object:Gem::Dependency
|
56
56
|
name: stud
|
57
|
-
|
57
|
+
requirement: !ruby/object:Gem::Requirement
|
58
58
|
requirements:
|
59
|
-
- -
|
59
|
+
- - ">="
|
60
60
|
- !ruby/object:Gem::Version
|
61
61
|
version: 0.0.22
|
62
|
-
- - <
|
62
|
+
- - "<"
|
63
63
|
- !ruby/object:Gem::Version
|
64
64
|
version: 0.1.0
|
65
|
-
|
65
|
+
type: :runtime
|
66
|
+
prerelease: false
|
67
|
+
version_requirements: !ruby/object:Gem::Requirement
|
66
68
|
requirements:
|
67
|
-
- -
|
69
|
+
- - ">="
|
68
70
|
- !ruby/object:Gem::Version
|
69
71
|
version: 0.0.22
|
70
|
-
- - <
|
72
|
+
- - "<"
|
71
73
|
- !ruby/object:Gem::Version
|
72
74
|
version: 0.1.0
|
73
|
-
prerelease: false
|
74
|
-
type: :runtime
|
75
75
|
- !ruby/object:Gem::Dependency
|
76
76
|
name: logstash-codec-plain
|
77
|
-
version_requirements: !ruby/object:Gem::Requirement
|
78
|
-
requirements:
|
79
|
-
- - '>='
|
80
|
-
- !ruby/object:Gem::Version
|
81
|
-
version: '0'
|
82
77
|
requirement: !ruby/object:Gem::Requirement
|
83
78
|
requirements:
|
84
|
-
- -
|
79
|
+
- - ">="
|
85
80
|
- !ruby/object:Gem::Version
|
86
81
|
version: '0'
|
87
|
-
prerelease: false
|
88
82
|
type: :runtime
|
89
|
-
|
90
|
-
name: logstash-filter-grok
|
83
|
+
prerelease: false
|
91
84
|
version_requirements: !ruby/object:Gem::Requirement
|
92
85
|
requirements:
|
93
|
-
- -
|
86
|
+
- - ">="
|
94
87
|
- !ruby/object:Gem::Version
|
95
88
|
version: '0'
|
89
|
+
- !ruby/object:Gem::Dependency
|
90
|
+
name: logstash-filter-grok
|
96
91
|
requirement: !ruby/object:Gem::Requirement
|
97
92
|
requirements:
|
98
|
-
- -
|
93
|
+
- - ">="
|
99
94
|
- !ruby/object:Gem::Version
|
100
95
|
version: '0'
|
101
|
-
prerelease: false
|
102
96
|
type: :runtime
|
103
|
-
|
104
|
-
name: logstash-filter-date
|
97
|
+
prerelease: false
|
105
98
|
version_requirements: !ruby/object:Gem::Requirement
|
106
99
|
requirements:
|
107
|
-
- -
|
100
|
+
- - ">="
|
108
101
|
- !ruby/object:Gem::Version
|
109
102
|
version: '0'
|
103
|
+
- !ruby/object:Gem::Dependency
|
104
|
+
name: logstash-filter-date
|
110
105
|
requirement: !ruby/object:Gem::Requirement
|
111
106
|
requirements:
|
112
|
-
- -
|
107
|
+
- - ">="
|
113
108
|
- !ruby/object:Gem::Version
|
114
109
|
version: '0'
|
115
|
-
prerelease: false
|
116
110
|
type: :runtime
|
117
|
-
|
118
|
-
name: logstash-devutils
|
111
|
+
prerelease: false
|
119
112
|
version_requirements: !ruby/object:Gem::Requirement
|
120
113
|
requirements:
|
121
|
-
- -
|
114
|
+
- - ">="
|
122
115
|
- !ruby/object:Gem::Version
|
123
116
|
version: '0'
|
117
|
+
- !ruby/object:Gem::Dependency
|
118
|
+
name: logstash-devutils
|
124
119
|
requirement: !ruby/object:Gem::Requirement
|
125
120
|
requirements:
|
126
|
-
- -
|
121
|
+
- - ">="
|
127
122
|
- !ruby/object:Gem::Version
|
128
123
|
version: '0'
|
129
|
-
prerelease: false
|
130
124
|
type: :development
|
131
|
-
|
125
|
+
prerelease: false
|
126
|
+
version_requirements: !ruby/object:Gem::Requirement
|
127
|
+
requirements:
|
128
|
+
- - ">="
|
129
|
+
- !ruby/object:Gem::Version
|
130
|
+
version: '0'
|
131
|
+
description: This gem is a Logstash plugin required to be installed on top of the
|
132
|
+
Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
|
133
|
+
gem is not a stand-alone program
|
132
134
|
email: info@elastic.co
|
133
135
|
executables: []
|
134
136
|
extensions: []
|
@@ -149,24 +151,24 @@ licenses:
|
|
149
151
|
metadata:
|
150
152
|
logstash_plugin: 'true'
|
151
153
|
logstash_group: input
|
152
|
-
post_install_message:
|
154
|
+
post_install_message:
|
153
155
|
rdoc_options: []
|
154
156
|
require_paths:
|
155
157
|
- lib
|
156
158
|
required_ruby_version: !ruby/object:Gem::Requirement
|
157
159
|
requirements:
|
158
|
-
- -
|
160
|
+
- - ">="
|
159
161
|
- !ruby/object:Gem::Version
|
160
162
|
version: '0'
|
161
163
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
162
164
|
requirements:
|
163
|
-
- -
|
165
|
+
- - ">="
|
164
166
|
- !ruby/object:Gem::Version
|
165
167
|
version: '0'
|
166
168
|
requirements: []
|
167
|
-
rubyforge_project:
|
168
|
-
rubygems_version: 2.
|
169
|
-
signing_key:
|
169
|
+
rubyforge_project:
|
170
|
+
rubygems_version: 2.5.1
|
171
|
+
signing_key:
|
170
172
|
specification_version: 4
|
171
173
|
summary: Read syslog messages as events over the network.
|
172
174
|
test_files:
|