logstash-input-syslog 3.3.0 → 3.4.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +19 -0
- data/LICENSE +199 -10
- data/docs/index.asciidoc +42 -4
- data/lib/logstash/inputs/syslog.rb +22 -24
- data/logstash-input-syslog.gemspec +2 -2
- data/spec/inputs/syslog_spec.rb +69 -25
- metadata +16 -16
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 50ec0d9128316dbe4a546b2a2437e2b412dc96fce564ace036dd5b0a724ccd71
|
|
4
|
+
data.tar.gz: 200037f6000b598cf2abb5e13804343c455cf3c8af4239b12ae94bb570b93e90
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 799c2ca8d23eeb77d7c532fc5692db5c4a1e3c5a3e40c871b55892e3b9b332d2156dc1c205f67674eb2a196ad02a334fc19b6b05fc52ff18d0f36dfd209c6121
|
|
7
|
+
data.tar.gz: e802df38eed4687cf96da91b3bb0b1817cf30f7bef86583f532d35033c37702ffdf3b66f95e78cbf7ea408853caa154d69efa496391e4fc9ddaf18a05a8d489e
|
data/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,22 @@
|
|
|
1
|
+
## 3.4.4
|
|
2
|
+
- Refactor: avoid global side-effect + cleanup [#62](https://github.com/logstash-plugins/logstash-input-syslog/pull/62)
|
|
3
|
+
* avoid setting `BasicSocket.do_not_reverse_lookup` as it has side effects for others
|
|
4
|
+
|
|
5
|
+
## 3.4.3
|
|
6
|
+
- [DOC] Added expanded descriptions and requirements for facility_labels and severity_labels. [#52](https://github.com/logstash-plugins/logstash-input-syslog/pull/52)
|
|
7
|
+
|
|
8
|
+
## 3.4.2
|
|
9
|
+
- Remove (deprecated) dependency on thread_safe gem.
|
|
10
|
+
- CI: upgrade testing [#58](https://github.com/logstash-plugins/logstash-input-syslog/pull/58)
|
|
11
|
+
- [DOC] Correct example for `timezone` option [#53](https://github.com/logstash-plugins/logstash-input-syslog/pull/53)
|
|
12
|
+
|
|
13
|
+
## 3.4.1
|
|
14
|
+
- Docs: Set the default_codec doc attribute.
|
|
15
|
+
|
|
16
|
+
## 3.4.0
|
|
17
|
+
- Allow the syslog field to be a configurable option. This is useful for when codecs change
|
|
18
|
+
the field containing the syslog data (e.g. the CEF codec).
|
|
19
|
+
|
|
1
20
|
## 3.3.0
|
|
2
21
|
- Make the grok pattern a configurable option
|
|
3
22
|
|
data/LICENSE
CHANGED
|
@@ -1,13 +1,202 @@
|
|
|
1
|
-
Copyright (c) 2012-2018 Elasticsearch <http://www.elastic.co>
|
|
2
1
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
2
|
+
Apache License
|
|
3
|
+
Version 2.0, January 2004
|
|
4
|
+
http://www.apache.org/licenses/
|
|
6
5
|
|
|
7
|
-
|
|
6
|
+
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
|
8
7
|
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
8
|
+
1. Definitions.
|
|
9
|
+
|
|
10
|
+
"License" shall mean the terms and conditions for use, reproduction,
|
|
11
|
+
and distribution as defined by Sections 1 through 9 of this document.
|
|
12
|
+
|
|
13
|
+
"Licensor" shall mean the copyright owner or entity authorized by
|
|
14
|
+
the copyright owner that is granting the License.
|
|
15
|
+
|
|
16
|
+
"Legal Entity" shall mean the union of the acting entity and all
|
|
17
|
+
other entities that control, are controlled by, or are under common
|
|
18
|
+
control with that entity. For the purposes of this definition,
|
|
19
|
+
"control" means (i) the power, direct or indirect, to cause the
|
|
20
|
+
direction or management of such entity, whether by contract or
|
|
21
|
+
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
|
22
|
+
outstanding shares, or (iii) beneficial ownership of such entity.
|
|
23
|
+
|
|
24
|
+
"You" (or "Your") shall mean an individual or Legal Entity
|
|
25
|
+
exercising permissions granted by this License.
|
|
26
|
+
|
|
27
|
+
"Source" form shall mean the preferred form for making modifications,
|
|
28
|
+
including but not limited to software source code, documentation
|
|
29
|
+
source, and configuration files.
|
|
30
|
+
|
|
31
|
+
"Object" form shall mean any form resulting from mechanical
|
|
32
|
+
transformation or translation of a Source form, including but
|
|
33
|
+
not limited to compiled object code, generated documentation,
|
|
34
|
+
and conversions to other media types.
|
|
35
|
+
|
|
36
|
+
"Work" shall mean the work of authorship, whether in Source or
|
|
37
|
+
Object form, made available under the License, as indicated by a
|
|
38
|
+
copyright notice that is included in or attached to the work
|
|
39
|
+
(an example is provided in the Appendix below).
|
|
40
|
+
|
|
41
|
+
"Derivative Works" shall mean any work, whether in Source or Object
|
|
42
|
+
form, that is based on (or derived from) the Work and for which the
|
|
43
|
+
editorial revisions, annotations, elaborations, or other modifications
|
|
44
|
+
represent, as a whole, an original work of authorship. For the purposes
|
|
45
|
+
of this License, Derivative Works shall not include works that remain
|
|
46
|
+
separable from, or merely link (or bind by name) to the interfaces of,
|
|
47
|
+
the Work and Derivative Works thereof.
|
|
48
|
+
|
|
49
|
+
"Contribution" shall mean any work of authorship, including
|
|
50
|
+
the original version of the Work and any modifications or additions
|
|
51
|
+
to that Work or Derivative Works thereof, that is intentionally
|
|
52
|
+
submitted to Licensor for inclusion in the Work by the copyright owner
|
|
53
|
+
or by an individual or Legal Entity authorized to submit on behalf of
|
|
54
|
+
the copyright owner. For the purposes of this definition, "submitted"
|
|
55
|
+
means any form of electronic, verbal, or written communication sent
|
|
56
|
+
to the Licensor or its representatives, including but not limited to
|
|
57
|
+
communication on electronic mailing lists, source code control systems,
|
|
58
|
+
and issue tracking systems that are managed by, or on behalf of, the
|
|
59
|
+
Licensor for the purpose of discussing and improving the Work, but
|
|
60
|
+
excluding communication that is conspicuously marked or otherwise
|
|
61
|
+
designated in writing by the copyright owner as "Not a Contribution."
|
|
62
|
+
|
|
63
|
+
"Contributor" shall mean Licensor and any individual or Legal Entity
|
|
64
|
+
on behalf of whom a Contribution has been received by Licensor and
|
|
65
|
+
subsequently incorporated within the Work.
|
|
66
|
+
|
|
67
|
+
2. Grant of Copyright License. Subject to the terms and conditions of
|
|
68
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
69
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
70
|
+
copyright license to reproduce, prepare Derivative Works of,
|
|
71
|
+
publicly display, publicly perform, sublicense, and distribute the
|
|
72
|
+
Work and such Derivative Works in Source or Object form.
|
|
73
|
+
|
|
74
|
+
3. Grant of Patent License. Subject to the terms and conditions of
|
|
75
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
76
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
77
|
+
(except as stated in this section) patent license to make, have made,
|
|
78
|
+
use, offer to sell, sell, import, and otherwise transfer the Work,
|
|
79
|
+
where such license applies only to those patent claims licensable
|
|
80
|
+
by such Contributor that are necessarily infringed by their
|
|
81
|
+
Contribution(s) alone or by combination of their Contribution(s)
|
|
82
|
+
with the Work to which such Contribution(s) was submitted. If You
|
|
83
|
+
institute patent litigation against any entity (including a
|
|
84
|
+
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
|
85
|
+
or a Contribution incorporated within the Work constitutes direct
|
|
86
|
+
or contributory patent infringement, then any patent licenses
|
|
87
|
+
granted to You under this License for that Work shall terminate
|
|
88
|
+
as of the date such litigation is filed.
|
|
89
|
+
|
|
90
|
+
4. Redistribution. You may reproduce and distribute copies of the
|
|
91
|
+
Work or Derivative Works thereof in any medium, with or without
|
|
92
|
+
modifications, and in Source or Object form, provided that You
|
|
93
|
+
meet the following conditions:
|
|
94
|
+
|
|
95
|
+
(a) You must give any other recipients of the Work or
|
|
96
|
+
Derivative Works a copy of this License; and
|
|
97
|
+
|
|
98
|
+
(b) You must cause any modified files to carry prominent notices
|
|
99
|
+
stating that You changed the files; and
|
|
100
|
+
|
|
101
|
+
(c) You must retain, in the Source form of any Derivative Works
|
|
102
|
+
that You distribute, all copyright, patent, trademark, and
|
|
103
|
+
attribution notices from the Source form of the Work,
|
|
104
|
+
excluding those notices that do not pertain to any part of
|
|
105
|
+
the Derivative Works; and
|
|
106
|
+
|
|
107
|
+
(d) If the Work includes a "NOTICE" text file as part of its
|
|
108
|
+
distribution, then any Derivative Works that You distribute must
|
|
109
|
+
include a readable copy of the attribution notices contained
|
|
110
|
+
within such NOTICE file, excluding those notices that do not
|
|
111
|
+
pertain to any part of the Derivative Works, in at least one
|
|
112
|
+
of the following places: within a NOTICE text file distributed
|
|
113
|
+
as part of the Derivative Works; within the Source form or
|
|
114
|
+
documentation, if provided along with the Derivative Works; or,
|
|
115
|
+
within a display generated by the Derivative Works, if and
|
|
116
|
+
wherever such third-party notices normally appear. The contents
|
|
117
|
+
of the NOTICE file are for informational purposes only and
|
|
118
|
+
do not modify the License. You may add Your own attribution
|
|
119
|
+
notices within Derivative Works that You distribute, alongside
|
|
120
|
+
or as an addendum to the NOTICE text from the Work, provided
|
|
121
|
+
that such additional attribution notices cannot be construed
|
|
122
|
+
as modifying the License.
|
|
123
|
+
|
|
124
|
+
You may add Your own copyright statement to Your modifications and
|
|
125
|
+
may provide additional or different license terms and conditions
|
|
126
|
+
for use, reproduction, or distribution of Your modifications, or
|
|
127
|
+
for any such Derivative Works as a whole, provided Your use,
|
|
128
|
+
reproduction, and distribution of the Work otherwise complies with
|
|
129
|
+
the conditions stated in this License.
|
|
130
|
+
|
|
131
|
+
5. Submission of Contributions. Unless You explicitly state otherwise,
|
|
132
|
+
any Contribution intentionally submitted for inclusion in the Work
|
|
133
|
+
by You to the Licensor shall be under the terms and conditions of
|
|
134
|
+
this License, without any additional terms or conditions.
|
|
135
|
+
Notwithstanding the above, nothing herein shall supersede or modify
|
|
136
|
+
the terms of any separate license agreement you may have executed
|
|
137
|
+
with Licensor regarding such Contributions.
|
|
138
|
+
|
|
139
|
+
6. Trademarks. This License does not grant permission to use the trade
|
|
140
|
+
names, trademarks, service marks, or product names of the Licensor,
|
|
141
|
+
except as required for reasonable and customary use in describing the
|
|
142
|
+
origin of the Work and reproducing the content of the NOTICE file.
|
|
143
|
+
|
|
144
|
+
7. Disclaimer of Warranty. Unless required by applicable law or
|
|
145
|
+
agreed to in writing, Licensor provides the Work (and each
|
|
146
|
+
Contributor provides its Contributions) on an "AS IS" BASIS,
|
|
147
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
|
148
|
+
implied, including, without limitation, any warranties or conditions
|
|
149
|
+
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
|
150
|
+
PARTICULAR PURPOSE. You are solely responsible for determining the
|
|
151
|
+
appropriateness of using or redistributing the Work and assume any
|
|
152
|
+
risks associated with Your exercise of permissions under this License.
|
|
153
|
+
|
|
154
|
+
8. Limitation of Liability. In no event and under no legal theory,
|
|
155
|
+
whether in tort (including negligence), contract, or otherwise,
|
|
156
|
+
unless required by applicable law (such as deliberate and grossly
|
|
157
|
+
negligent acts) or agreed to in writing, shall any Contributor be
|
|
158
|
+
liable to You for damages, including any direct, indirect, special,
|
|
159
|
+
incidental, or consequential damages of any character arising as a
|
|
160
|
+
result of this License or out of the use or inability to use the
|
|
161
|
+
Work (including but not limited to damages for loss of goodwill,
|
|
162
|
+
work stoppage, computer failure or malfunction, or any and all
|
|
163
|
+
other commercial damages or losses), even if such Contributor
|
|
164
|
+
has been advised of the possibility of such damages.
|
|
165
|
+
|
|
166
|
+
9. Accepting Warranty or Additional Liability. While redistributing
|
|
167
|
+
the Work or Derivative Works thereof, You may choose to offer,
|
|
168
|
+
and charge a fee for, acceptance of support, warranty, indemnity,
|
|
169
|
+
or other liability obligations and/or rights consistent with this
|
|
170
|
+
License. However, in accepting such obligations, You may act only
|
|
171
|
+
on Your own behalf and on Your sole responsibility, not on behalf
|
|
172
|
+
of any other Contributor, and only if You agree to indemnify,
|
|
173
|
+
defend, and hold each Contributor harmless for any liability
|
|
174
|
+
incurred by, or claims asserted against, such Contributor by reason
|
|
175
|
+
of your accepting any such warranty or additional liability.
|
|
176
|
+
|
|
177
|
+
END OF TERMS AND CONDITIONS
|
|
178
|
+
|
|
179
|
+
APPENDIX: How to apply the Apache License to your work.
|
|
180
|
+
|
|
181
|
+
To apply the Apache License to your work, attach the following
|
|
182
|
+
boilerplate notice, with the fields enclosed by brackets "[]"
|
|
183
|
+
replaced with your own identifying information. (Don't include
|
|
184
|
+
the brackets!) The text should be enclosed in the appropriate
|
|
185
|
+
comment syntax for the file format. We also recommend that a
|
|
186
|
+
file or class name and description of purpose be included on the
|
|
187
|
+
same "printed page" as the copyright notice for easier
|
|
188
|
+
identification within third-party archives.
|
|
189
|
+
|
|
190
|
+
Copyright 2020 Elastic and contributors
|
|
191
|
+
|
|
192
|
+
Licensed under the Apache License, Version 2.0 (the "License");
|
|
193
|
+
you may not use this file except in compliance with the License.
|
|
194
|
+
You may obtain a copy of the License at
|
|
195
|
+
|
|
196
|
+
http://www.apache.org/licenses/LICENSE-2.0
|
|
197
|
+
|
|
198
|
+
Unless required by applicable law or agreed to in writing, software
|
|
199
|
+
distributed under the License is distributed on an "AS IS" BASIS,
|
|
200
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
201
|
+
See the License for the specific language governing permissions and
|
|
202
|
+
limitations under the License.
|
data/docs/index.asciidoc
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
:plugin: syslog
|
|
2
2
|
:type: input
|
|
3
|
+
:default_codec: plain
|
|
3
4
|
|
|
4
5
|
///////////////////////////////////////////
|
|
5
6
|
START - GENERATED VARIABLES, DO NOT EDIT!
|
|
@@ -53,6 +54,7 @@ This plugin supports the following configuration options plus the < |
|
|
53
54
|
| <<plugins-{type}s-{plugin}-port>> |<<number,number>>|No
|
|
54
55
|
| <<plugins-{type}s-{plugin}-proxy_protocol>> |<<boolean,boolean>>|No
|
|
55
56
|
| <<plugins-{type}s-{plugin}-severity_labels>> |<<array,array>>|No
|
|
57
|
+
| <<plugins-{type}s-{plugin}-syslog_field>> |<<string,string>>|No
|
|
56
58
|
| <<plugins-{type}s-{plugin}-timezone>> |<<string,string>>|No
|
|
57
59
|
| <<plugins-{type}s-{plugin}-use_labels>> |<<boolean,boolean>>|No
|
|
58
60
|
|=======================================================================
|
|
@@ -68,7 +70,14 @@ input plugins.
|
|
|
68
70
|
* Value type is <<array,array>>
|
|
69
71
|
* Default value is `["kernel", "user-level", "mail", "system", "security/authorization", "syslogd", "line printer", "network news", "UUCP", "clock", "security/authorization", "FTP", "NTP", "log audit", "log alert", "clock", "local0", "local1", "local2", "local3", "local4", "local5", "local6", "local7"]`
|
|
70
72
|
|
|
71
|
-
Labels for facility levels
|
|
73
|
+
Labels for facility levels defined in RFC3164.
|
|
74
|
+
|
|
75
|
+
You can use this option to override the integer->label mapping for syslog inputs
|
|
76
|
+
that behave differently than the RFCs.
|
|
77
|
+
|
|
78
|
+
Provide a zero-indexed array with all of your facility labels _in order_.
|
|
79
|
+
If a log message contains a facility number with no corresponding entry,
|
|
80
|
+
the facility_label is not added to the event.
|
|
72
81
|
|
|
73
82
|
[id="plugins-{type}s-{plugin}-grok_pattern"]
|
|
74
83
|
===== `grok_pattern`
|
|
@@ -134,7 +143,34 @@ http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt
|
|
|
134
143
|
* Value type is <<array,array>>
|
|
135
144
|
* Default value is `["Emergency", "Alert", "Critical", "Error", "Warning", "Notice", "Informational", "Debug"]`
|
|
136
145
|
|
|
137
|
-
Labels for severity levels
|
|
146
|
+
Labels for severity levels defined in RFC3164.
|
|
147
|
+
|
|
148
|
+
Provide a zero-indexed array with all of your severity labels _in order_.
|
|
149
|
+
If a log message contains a severity label with no corresponding entry,
|
|
150
|
+
the severity_label is not added to the event.
|
|
151
|
+
|
|
152
|
+
[id="plugins-{type}s-{plugin}-syslog_field"]
|
|
153
|
+
===== `syslog_field`
|
|
154
|
+
|
|
155
|
+
* Value type is <<string,string>>
|
|
156
|
+
* Default value is `"message"`
|
|
157
|
+
|
|
158
|
+
Codecs process the data before the rest of the data is parsed. Some codecs,
|
|
159
|
+
like CEF, put the syslog data into another field after pre-processing the
|
|
160
|
+
data. Use this option in conjunction with the `grok_pattern` configuration
|
|
161
|
+
to allow the syslog input plugin to fully parse the syslog data in this case.
|
|
162
|
+
|
|
163
|
+
[source,sh]
|
|
164
|
+
-------
|
|
165
|
+
input {
|
|
166
|
+
syslog {
|
|
167
|
+
port => 12345
|
|
168
|
+
codec => cef
|
|
169
|
+
syslog_field => "syslog"
|
|
170
|
+
grok_pattern => "<%{POSINT:priority}>%{SYSLOGTIMESTAMP:timestamp} CUSTOM GROK HERE"
|
|
171
|
+
}
|
|
172
|
+
}
|
|
173
|
+
-------
|
|
138
174
|
|
|
139
175
|
[id="plugins-{type}s-{plugin}-timezone"]
|
|
140
176
|
===== `timezone`
|
|
@@ -147,8 +183,8 @@ The valid IDs are listed on the [Joda.org available time zones page](http://joda
|
|
|
147
183
|
This is useful in case the time zone cannot be extracted from the value,
|
|
148
184
|
and is not the platform default.
|
|
149
185
|
If this is not specified the platform default will be used.
|
|
150
|
-
Canonical ID is good as it takes care of daylight saving time for you
|
|
151
|
-
For example, `America/Los_Angeles` or `Europe/
|
|
186
|
+
Canonical ID is good as it takes care of daylight saving time for you.
|
|
187
|
+
For example, `America/Los_Angeles` or `Europe/Paris` are valid IDs.
|
|
152
188
|
|
|
153
189
|
[id="plugins-{type}s-{plugin}-use_labels"]
|
|
154
190
|
===== `use_labels`
|
|
@@ -162,3 +198,5 @@ Use label parsing for severity and facility levels.
|
|
|
162
198
|
|
|
163
199
|
[id="plugins-{type}s-{plugin}-common-options"]
|
|
164
200
|
include::{include_path}/{type}.asciidoc[]
|
|
201
|
+
|
|
202
|
+
:default_codec!:
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
# encoding: utf-8
|
|
2
2
|
require "date"
|
|
3
3
|
require "socket"
|
|
4
|
-
require "concurrent"
|
|
4
|
+
require "concurrent/array"
|
|
5
5
|
require "logstash/filters/grok"
|
|
6
6
|
require "logstash/filters/date"
|
|
7
7
|
require "logstash/inputs/base"
|
|
@@ -36,6 +36,10 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
|
36
36
|
# ports) may require root to use.
|
|
37
37
|
config :port, :validate => :number, :default => 514
|
|
38
38
|
|
|
39
|
+
# Use custom post-codec processing field (e.g. syslog, after cef codec
|
|
40
|
+
# processing) instead of the default `message` field
|
|
41
|
+
config :syslog_field, :validate => :string, :default => "message"
|
|
42
|
+
|
|
39
43
|
# Set custom grok pattern to parse the syslog, in case the format differs
|
|
40
44
|
# from the defined standard. This is common in security and other appliances
|
|
41
45
|
config :grok_pattern, :validate => :string, :default => "<%{POSINT:priority}>%{SYSLOGLINE}"
|
|
@@ -55,8 +59,7 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
|
55
59
|
|
|
56
60
|
# Specify a time zone canonical ID to be used for date parsing.
|
|
57
61
|
# The valid IDs are listed on the [Joda.org available time zones page](http://joda-time.sourceforge.net/timezones.html).
|
|
58
|
-
# This is useful in case the time zone cannot be extracted from the value,
|
|
59
|
-
# and is not the platform default.
|
|
62
|
+
# This is useful in case the time zone cannot be extracted from the value, and is not the platform default.
|
|
60
63
|
# If this is not specified the platform default will be used.
|
|
61
64
|
# Canonical ID is good as it takes care of daylight saving time for you
|
|
62
65
|
# For example, `America/Los_Angeles` or `Europe/France` are valid IDs.
|
|
@@ -71,19 +74,13 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
|
71
74
|
#
|
|
72
75
|
config :locale, :validate => :string
|
|
73
76
|
|
|
74
|
-
public
|
|
75
|
-
def initialize(params)
|
|
76
|
-
super
|
|
77
|
-
BasicSocket.do_not_reverse_lookup = true
|
|
78
|
-
end # def initialize
|
|
79
|
-
|
|
80
77
|
public
|
|
81
78
|
def register
|
|
82
79
|
@metric_errors = metric.namespace(:errors)
|
|
83
|
-
|
|
80
|
+
|
|
84
81
|
@grok_filter = LogStash::Filters::Grok.new(
|
|
85
|
-
"overwrite" =>
|
|
86
|
-
"match" => {
|
|
82
|
+
"overwrite" => @syslog_field,
|
|
83
|
+
"match" => { @syslog_field => @grok_pattern },
|
|
87
84
|
"tag_on_failure" => ["_grokparsefailure_sysloginput"],
|
|
88
85
|
)
|
|
89
86
|
|
|
@@ -96,7 +93,7 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
|
96
93
|
@grok_filter.register
|
|
97
94
|
@date_filter.register
|
|
98
95
|
|
|
99
|
-
@tcp_sockets =
|
|
96
|
+
@tcp_sockets = Concurrent::Array.new
|
|
100
97
|
@tcp = @udp = nil
|
|
101
98
|
end # def register
|
|
102
99
|
|
|
@@ -142,6 +139,7 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
|
142
139
|
|
|
143
140
|
@udp.close if @udp
|
|
144
141
|
@udp = UDPSocket.new(Socket::AF_INET)
|
|
142
|
+
@udp.do_not_reverse_lookup = true
|
|
145
143
|
@udp.bind(@host, @port)
|
|
146
144
|
|
|
147
145
|
while !stop?
|
|
@@ -161,6 +159,7 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
|
161
159
|
def tcp_listener(output_queue)
|
|
162
160
|
@logger.info("Starting syslog tcp listener", :address => "#{@host}:#{@port}")
|
|
163
161
|
@tcp = TCPServer.new(@host, @port)
|
|
162
|
+
@tcp.do_not_reverse_lookup = true
|
|
164
163
|
|
|
165
164
|
while !stop?
|
|
166
165
|
socket = @tcp.accept
|
|
@@ -213,7 +212,7 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
|
213
212
|
logger.info("connection error: #{ioerror.message}")
|
|
214
213
|
ensure
|
|
215
214
|
@tcp_sockets.delete(socket)
|
|
216
|
-
socket.close rescue log_and_squash
|
|
215
|
+
socket.close rescue log_and_squash(:close_tcp_receiver_socket)
|
|
217
216
|
end
|
|
218
217
|
|
|
219
218
|
private
|
|
@@ -227,7 +226,7 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
|
227
226
|
end
|
|
228
227
|
rescue => e
|
|
229
228
|
# swallow and log all decoding exceptions, these will never be socket related
|
|
230
|
-
@logger.error("Error decoding data", :data => data.inspect, :exception => e, :backtrace => e.backtrace)
|
|
229
|
+
@logger.error("Error decoding data", :data => data.inspect, :exception => e.class, :message => e.message, :backtrace => e.backtrace)
|
|
231
230
|
@metric_errors.increment(:decoding)
|
|
232
231
|
end
|
|
233
232
|
|
|
@@ -240,16 +239,15 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
|
240
239
|
private
|
|
241
240
|
def close_udp
|
|
242
241
|
if @udp
|
|
243
|
-
@udp.close_read rescue log_and_squash
|
|
244
|
-
@udp.close_write rescue log_and_squash
|
|
242
|
+
@udp.close_read rescue log_and_squash(:close_udp_read)
|
|
243
|
+
@udp.close_write rescue log_and_squash(:close_udp_write)
|
|
245
244
|
end
|
|
246
245
|
@udp = nil
|
|
247
246
|
end
|
|
248
247
|
|
|
249
248
|
private
|
|
250
249
|
|
|
251
|
-
# Helper for inline rescues, which logs the
|
|
252
|
-
# and returns nil.
|
|
250
|
+
# Helper for inline rescues, which logs the exception at "DEBUG" level and returns nil.
|
|
253
251
|
#
|
|
254
252
|
# Instead of:
|
|
255
253
|
# ~~~ ruby
|
|
@@ -257,19 +255,19 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
|
|
|
257
255
|
# ~~~
|
|
258
256
|
# Do:
|
|
259
257
|
# ~~~ ruby
|
|
260
|
-
#. foo rescue log_and_squash
|
|
258
|
+
#. foo rescue log_and_squash(:foo)
|
|
261
259
|
# ~~~
|
|
262
|
-
def log_and_squash
|
|
263
|
-
$! && logger.
|
|
260
|
+
def log_and_squash(label)
|
|
261
|
+
$! && logger.debug("#{label} failed:", :exception => $!.class, :message => $!.message)
|
|
264
262
|
nil
|
|
265
263
|
end
|
|
266
264
|
|
|
267
265
|
def close_tcp
|
|
268
266
|
# If we somehow have this left open, close it.
|
|
269
267
|
@tcp_sockets.each do |socket|
|
|
270
|
-
socket.close rescue log_and_squash
|
|
268
|
+
socket.close rescue log_and_squash(:close_tcp_socket)
|
|
271
269
|
end
|
|
272
|
-
@tcp.close if @tcp rescue log_and_squash
|
|
270
|
+
@tcp.close if @tcp rescue log_and_squash(:close_tcp)
|
|
273
271
|
@tcp = nil
|
|
274
272
|
end
|
|
275
273
|
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
Gem::Specification.new do |s|
|
|
2
2
|
|
|
3
3
|
s.name = 'logstash-input-syslog'
|
|
4
|
-
s.version = '3.
|
|
4
|
+
s.version = '3.4.4'
|
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
|
6
6
|
s.summary = "Reads syslog messages as events"
|
|
7
7
|
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
|
@@ -23,7 +23,6 @@ Gem::Specification.new do |s|
|
|
|
23
23
|
s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
|
|
24
24
|
|
|
25
25
|
s.add_runtime_dependency 'concurrent-ruby'
|
|
26
|
-
s.add_runtime_dependency 'thread_safe'
|
|
27
26
|
s.add_runtime_dependency 'stud', '>= 0.0.22', '< 0.1.0'
|
|
28
27
|
|
|
29
28
|
s.add_runtime_dependency 'logstash-codec-plain'
|
|
@@ -31,5 +30,6 @@ Gem::Specification.new do |s|
|
|
|
31
30
|
s.add_runtime_dependency 'logstash-filter-date'
|
|
32
31
|
|
|
33
32
|
s.add_development_dependency 'logstash-devutils'
|
|
33
|
+
s.add_development_dependency 'logstash-codec-cef'
|
|
34
34
|
end
|
|
35
35
|
|
data/spec/inputs/syslog_spec.rb
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
# encoding: utf-8
|
|
2
2
|
require "logstash/devutils/rspec/spec_helper"
|
|
3
|
+
require "logstash/devutils/rspec/shared_examples"
|
|
3
4
|
|
|
4
5
|
# running the grok code outside a logstash package means
|
|
5
6
|
# LOGSTASH_HOME will not be defined, so let's set it here
|
|
@@ -22,6 +23,7 @@ module LogStash::Environment
|
|
|
22
23
|
end
|
|
23
24
|
|
|
24
25
|
require "logstash/inputs/syslog"
|
|
26
|
+
require "logstash/codecs/cef"
|
|
25
27
|
require "logstash/event"
|
|
26
28
|
require "stud/try"
|
|
27
29
|
require "socket"
|
|
@@ -30,6 +32,7 @@ describe LogStash::Inputs::Syslog do
|
|
|
30
32
|
SYSLOG_LINE = "<164>Oct 26 15:19:25 1.2.3.4 %ASA-4-106023: Deny udp src DRAC:10.1.2.3/43434 dst outside:192.168.0.1/53 by access-group \"acl_drac\" [0x0, 0x0]"
|
|
31
33
|
|
|
32
34
|
it "should properly handle priority, severity and facilities" do
|
|
35
|
+
skip 'elastic/logstash#11196 known LS 7.5 issue' if ENV['ELASTIC_STACK_VERSION'] && JRUBY_VERSION.eql?('9.2.8.0')
|
|
33
36
|
port = 5511
|
|
34
37
|
event_count = 10
|
|
35
38
|
conf = <<-CONFIG
|
|
@@ -51,15 +54,16 @@ describe LogStash::Inputs::Syslog do
|
|
|
51
54
|
event_count.times.collect { queue.pop }
|
|
52
55
|
end
|
|
53
56
|
|
|
54
|
-
|
|
57
|
+
expect( events.length ).to eql event_count
|
|
55
58
|
events.each do |event|
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
+
expect( event.get("priority") ).to eql 164
|
|
60
|
+
expect( event.get("severity") ).to eql 4
|
|
61
|
+
expect( event.get("facility") ).to eql 20
|
|
59
62
|
end
|
|
60
63
|
end
|
|
61
64
|
|
|
62
65
|
it "should properly PROXY protocol v1" do
|
|
66
|
+
skip 'elastic/logstash#11196 known LS 7.5 issue' if ENV['ELASTIC_STACK_VERSION'] && JRUBY_VERSION.eql?('9.2.8.0')
|
|
63
67
|
port = 5511
|
|
64
68
|
event_count = 10
|
|
65
69
|
conf = <<-CONFIG
|
|
@@ -84,16 +88,17 @@ describe LogStash::Inputs::Syslog do
|
|
|
84
88
|
event_count.times.collect { queue.pop }
|
|
85
89
|
end
|
|
86
90
|
|
|
87
|
-
|
|
91
|
+
expect( events.length ).to eql event_count
|
|
88
92
|
events.each do |event|
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
+
expect( event.get("priority") ).to eql 164
|
|
94
|
+
expect( event.get("severity") ).to eql 4
|
|
95
|
+
expect( event.get("facility") ).to eql 20
|
|
96
|
+
expect( event.get("host") ).to eql "1.2.3.4"
|
|
93
97
|
end
|
|
94
98
|
end
|
|
95
99
|
|
|
96
100
|
it "should add unique tag when grok parsing fails with live syslog input" do
|
|
101
|
+
skip 'elastic/logstash#11196 known LS 7.5 issue' if ENV['ELASTIC_STACK_VERSION'] && JRUBY_VERSION.eql?('9.2.8.0')
|
|
97
102
|
port = 5511
|
|
98
103
|
event_count = 10
|
|
99
104
|
conf = <<-CONFIG
|
|
@@ -115,9 +120,9 @@ describe LogStash::Inputs::Syslog do
|
|
|
115
120
|
event_count.times.collect { queue.pop }
|
|
116
121
|
end
|
|
117
122
|
|
|
118
|
-
|
|
123
|
+
expect( events.length ).to eql event_count
|
|
119
124
|
event_count.times do |i|
|
|
120
|
-
|
|
125
|
+
expect( events[i].get("tags") ).to eql ["_grokparsefailure_sysloginput"]
|
|
121
126
|
end
|
|
122
127
|
end
|
|
123
128
|
|
|
@@ -146,9 +151,9 @@ describe LogStash::Inputs::Syslog do
|
|
|
146
151
|
event_count.times.collect { queue.pop }
|
|
147
152
|
end
|
|
148
153
|
|
|
149
|
-
|
|
154
|
+
expect( events.length ).to eql event_count
|
|
150
155
|
events.each do |event|
|
|
151
|
-
|
|
156
|
+
expect( event.get("@timestamp").to_iso8601 ).to eql "#{Time.now.year}-10-26T15:19:25.000Z"
|
|
152
157
|
end
|
|
153
158
|
end
|
|
154
159
|
|
|
@@ -173,7 +178,7 @@ describe LogStash::Inputs::Syslog do
|
|
|
173
178
|
end
|
|
174
179
|
|
|
175
180
|
# chances platform timezone is not UTC so ignore the hours
|
|
176
|
-
|
|
181
|
+
expect( event.get("@timestamp").to_iso8601 ).to match /#{Time.now.year}-10-26T\d\d:19:25.000Z/
|
|
177
182
|
end
|
|
178
183
|
|
|
179
184
|
it "should support non UTC timezone" do
|
|
@@ -184,7 +189,7 @@ describe LogStash::Inputs::Syslog do
|
|
|
184
189
|
|
|
185
190
|
syslog_event = LogStash::Event.new({ "message" => "<164>Oct 26 15:19:25 1.2.3.4 %ASA-4-106023: Deny udp src DRAC:10.1.2.3/43434" })
|
|
186
191
|
input.syslog_relay(syslog_event)
|
|
187
|
-
|
|
192
|
+
expect( syslog_event.get("@timestamp").to_iso8601 ).to eql "#{Time.now.year}-10-26T20:19:25.000Z"
|
|
188
193
|
|
|
189
194
|
input.close
|
|
190
195
|
end
|
|
@@ -196,13 +201,13 @@ describe LogStash::Inputs::Syslog do
|
|
|
196
201
|
# event which is not syslog should have a new tag
|
|
197
202
|
event = LogStash::Event.new({ "message" => "hello world, this is not syslog RFC3164" })
|
|
198
203
|
input.syslog_relay(event)
|
|
199
|
-
|
|
204
|
+
expect( event.get("tags") ).to eql ["_grokparsefailure_sysloginput"]
|
|
200
205
|
|
|
201
206
|
syslog_event = LogStash::Event.new({ "message" => "<164>Oct 26 15:19:25 1.2.3.4 %ASA-4-106023: Deny udp src DRAC:10.1.2.3/43434" })
|
|
202
207
|
input.syslog_relay(syslog_event)
|
|
203
|
-
|
|
204
|
-
|
|
205
|
-
|
|
208
|
+
expect( syslog_event.get("priority") ).to eql 164
|
|
209
|
+
expect( syslog_event.get("severity") ).to eql 4
|
|
210
|
+
expect( syslog_event.get("tags") ).to be nil
|
|
206
211
|
|
|
207
212
|
input.close
|
|
208
213
|
end
|
|
@@ -239,13 +244,52 @@ describe LogStash::Inputs::Syslog do
|
|
|
239
244
|
event_count.times.collect { queue.pop }
|
|
240
245
|
end
|
|
241
246
|
|
|
242
|
-
|
|
247
|
+
expect( events.length ).to eql event_count
|
|
243
248
|
events.each do |event|
|
|
244
|
-
|
|
245
|
-
|
|
246
|
-
|
|
247
|
-
|
|
248
|
-
|
|
249
|
+
expect( event.get("priority") ).to eql 164
|
|
250
|
+
expect( event.get("severity") ).to eql 4
|
|
251
|
+
expect( event.get("facility") ).to eql 20
|
|
252
|
+
expect( event.get("message") ).to eql "#{message_field}\n"
|
|
253
|
+
expect( event.get("timestamp") ).to eql timestamp
|
|
254
|
+
end
|
|
255
|
+
end
|
|
256
|
+
|
|
257
|
+
it "should properly handle the cef codec with a custom grok_pattern" do
|
|
258
|
+
port = 5511
|
|
259
|
+
event_count = 1
|
|
260
|
+
custom_grok = "<%{POSINT:priority}>%{TIMESTAMP_ISO8601:timestamp} atypical"
|
|
261
|
+
message_field = "Description Omitted"
|
|
262
|
+
timestamp = "2018-02-07T12:40:00.000Z"
|
|
263
|
+
custom_line = "<134>#{timestamp} atypical CEF:0|Company Name|Application Name|Application Version Number|632|Syslog Configuration Updated|3|src=192.168.0.1 suser=user@example.com target=TARGET msg=#{message_field} KeyValueOne=kv1 KeyValueTwo=12345 "
|
|
264
|
+
|
|
265
|
+
conf = <<-CONFIG
|
|
266
|
+
input {
|
|
267
|
+
syslog {
|
|
268
|
+
port => #{port}
|
|
269
|
+
syslog_field => "syslog"
|
|
270
|
+
grok_pattern => "#{custom_grok}"
|
|
271
|
+
codec => cef
|
|
272
|
+
}
|
|
273
|
+
}
|
|
274
|
+
CONFIG
|
|
275
|
+
|
|
276
|
+
events = input(conf) do |pipeline, queue|
|
|
277
|
+
socket = Stud.try(5.times) { TCPSocket.new("127.0.0.1", port) }
|
|
278
|
+
event_count.times do |i|
|
|
279
|
+
socket.puts(custom_line)
|
|
280
|
+
end
|
|
281
|
+
socket.close
|
|
282
|
+
|
|
283
|
+
event_count.times.collect { queue.pop }
|
|
284
|
+
end
|
|
285
|
+
|
|
286
|
+
expect( events.length ).to eql event_count
|
|
287
|
+
events.each do |event|
|
|
288
|
+
expect( event.get("priority") ).to eql 134
|
|
289
|
+
expect( event.get("severity") ).to eql 6
|
|
290
|
+
expect( event.get("facility") ).to eql 16
|
|
291
|
+
expect( event.get("message") ).to eql message_field
|
|
292
|
+
expect( event.get("timestamp") ).to eql timestamp
|
|
249
293
|
end
|
|
250
294
|
end
|
|
251
295
|
end
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: logstash-input-syslog
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 3.
|
|
4
|
+
version: 3.4.4
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Elastic
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2020-07-23 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -44,20 +44,6 @@ dependencies:
|
|
|
44
44
|
- - ">="
|
|
45
45
|
- !ruby/object:Gem::Version
|
|
46
46
|
version: '0'
|
|
47
|
-
- !ruby/object:Gem::Dependency
|
|
48
|
-
requirement: !ruby/object:Gem::Requirement
|
|
49
|
-
requirements:
|
|
50
|
-
- - ">="
|
|
51
|
-
- !ruby/object:Gem::Version
|
|
52
|
-
version: '0'
|
|
53
|
-
name: thread_safe
|
|
54
|
-
prerelease: false
|
|
55
|
-
type: :runtime
|
|
56
|
-
version_requirements: !ruby/object:Gem::Requirement
|
|
57
|
-
requirements:
|
|
58
|
-
- - ">="
|
|
59
|
-
- !ruby/object:Gem::Version
|
|
60
|
-
version: '0'
|
|
61
47
|
- !ruby/object:Gem::Dependency
|
|
62
48
|
requirement: !ruby/object:Gem::Requirement
|
|
63
49
|
requirements:
|
|
@@ -134,6 +120,20 @@ dependencies:
|
|
|
134
120
|
- - ">="
|
|
135
121
|
- !ruby/object:Gem::Version
|
|
136
122
|
version: '0'
|
|
123
|
+
- !ruby/object:Gem::Dependency
|
|
124
|
+
requirement: !ruby/object:Gem::Requirement
|
|
125
|
+
requirements:
|
|
126
|
+
- - ">="
|
|
127
|
+
- !ruby/object:Gem::Version
|
|
128
|
+
version: '0'
|
|
129
|
+
name: logstash-codec-cef
|
|
130
|
+
prerelease: false
|
|
131
|
+
type: :development
|
|
132
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
133
|
+
requirements:
|
|
134
|
+
- - ">="
|
|
135
|
+
- !ruby/object:Gem::Version
|
|
136
|
+
version: '0'
|
|
137
137
|
description: This gem is a Logstash plugin required to be installed on top of the
|
|
138
138
|
Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
|
|
139
139
|
gem is not a stand-alone program
|