logstash-input-syslog 3.1.1 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0b55d82ad51230835773338aee830938b0598eab
-  data.tar.gz: bc94cbd60d89897f55f6911198e2838c49bdb301
+  metadata.gz: 2fe0893137a0245978babee198d6058ac7c42fbd
+  data.tar.gz: 941c695bfa50167e2669153fd9ff333ff56d1b46
 SHA512:
-  metadata.gz: f63fcdd232e1e461f4e94c5dac383971087bb2c76173e5f4a86230778b089124249e2e82e19cb53709c465c4e2f440247b5689ccd478c27f5a61972f57366aa8
-  data.tar.gz: 2b6726b6d2d9bfa736330e64a771d17c7192f35eee612e7aa6da355f623bc0b9c1ba2b9a0159b4cdc8901c9787c035739175fde77b9080237048e05ffcc4089f
+  metadata.gz: 2e7d1259985f95876b4b1f7abf60b45a301c5dd0279cd33c26c847a96033a58f203099160a6317312d8cf66140fd0b9179c5ae359f5f334cf7f5e46dc9d98fb1
+  data.tar.gz: 9aed2bba11e0962fc36d30d19a6a44654bcb1dd26194e1f990d98a51c19224c46f0f6954a13af655bf2542fbe1132657ca3da36063187fba8f00dfd8144ac7d7

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 3.2.0
+  - Add support for proxy protocol.
+
 ## 3.1.1
   - Move one log message from info to debug to avoid noise
 

data/lib/logstash/inputs/syslog.rb

@@ -36,6 +36,10 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
   # ports) may require root to use.
   config :port, :validate => :number, :default => 514
 
+  # Proxy protocol support, only v1 is supported at this time
+  # http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt
+  config :proxy_protocol, :validate => :boolean, :default => false
+
   # Use label parsing for severity and facility levels.
   config :use_labels, :validate => :boolean, :default => true
 
@@ -171,11 +175,26 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
   # tcp server thread and all tcp connections will be closed and the listener restarted.
   def tcp_receiver(output_queue, socket)
     ip, port = socket.peeraddr[3], socket.peeraddr[1]
+    first_read = true
     @logger.info("new connection", :client => "#{ip}:#{port}")
     LogStash::Util::set_thread_name("input|syslog|tcp|#{ip}:#{port}}")
 
     socket.each do |line|
       metric.increment(:messages_received)
+      if @proxy_protocol && first_read
+        first_read = false
+        pp_info = line.split(/\s/)
+        # PROXY proto clientip proxyip clientport proxyport
+        if pp_info[0] != "PROXY"
+          @logger.error("invalid proxy protocol header label", :hdr => line)
+          raise IOError
+        else
+          # would be nice to log the proxy host and port data as well, but minimizing changes
+          ip = pp_info[2]
+          port = pp_info[3]
+          next
+        end
+      end
       decode(ip, output_queue, line)
     end
   rescue Errno::ECONNRESET

data/logstash-input-syslog.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-input-syslog'
-  s.version         = '3.1.1'
+  s.version         = '3.2.0'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Read syslog messages as events over the network."
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

data/spec/inputs/syslog_spec.rb

@@ -59,6 +59,40 @@ describe LogStash::Inputs::Syslog do
     end
   end
 
+  it "should properly PROXY protocol v1" do
+    port = 5511
+    event_count = 10
+    conf = <<-CONFIG
+      input {
+        syslog {
+          type => "blah"
+          port => #{port}
+          proxy_protocol => true
+        }
+      }
+    CONFIG
+
+    events = input(conf) do |pipeline, queue|
+      socket = Stud.try(5.times) { TCPSocket.new("127.0.0.1", port) }
+      socket.puts("PROXY TCP4 1.2.3.4 5.6.7.8 1234 5678\r");
+      socket.flush
+      event_count.times do |i|
+        socket.puts(SYSLOG_LINE)
+      end
+      socket.close
+
+      event_count.times.collect { queue.pop }
+    end
+
+    insist { events.length } == event_count
+    events.each do |event|
+      insist { event.get("priority") } == 164
+      insist { event.get("severity") } == 4
+      insist { event.get("facility") } == 20
+      insist { event.get("host") } == "1.2.3.4"
+    end
+  end
+
   it "should add unique tag when grok parsing fails with live syslog input" do
     port = 5511
     event_count = 10

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-input-syslog
 version: !ruby/object:Gem::Version
-  version: 3.1.1
+  version: 3.2.0
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2016-09-15 00:00:00.000000000 Z
+date: 2016-11-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement