logstash-input-syslog 3.7.0 → 3.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0c25de14662bbd82e873e09199f770ae115e73ab837d78300ad23d2f1a5f8617
-  data.tar.gz: ce332bc77901424f297d992d43c08999fbc30cc69547af624ead0d3aef2486f7
+  metadata.gz: 630e8328b3161d33d8d34489893a654e8310aa871a827bceb3911454f149bd34
+  data.tar.gz: 8e7c5b275c4169a83a20cd0a2a41b4d3b746d9b4a7e5aedc6360f917cd9660cc
 SHA512:
-  metadata.gz: 5a1cf93965af7f77e9f543d339567c0cba16e481d325c345fea9fcd945a85f032ab87ff4f135c4ebff82c44f14365e650e9e6fe08ef546efab42c8ba56cd273e
-  data.tar.gz: b6c4d596cac63c5432717086040ba6fb03cb2f7ae17b813f7414facef60c33cd3f3ea3239e5933768e2ca03721e596744d3301126087bc224db1c8abb09e4d72
+  metadata.gz: 69270b0499c4768ec2bbacff35dd35aacdd8e24944ad24d873291c4e83ce780eecba5afeff97b10d360daaf14d0601c473f631b6af6f27a0b33d239c22ca93db
+  data.tar.gz: 361942102a239e8797c2364942659c31245ffcf5149203530d2e47834ff2d5b04c834bd2001aa07cfd363afe40918a5923b5da61b886d207aee251c70e0b57ff

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 3.7.1
+  - Fix issue where the priority field was not being set correctly when grok failed [#76](https://github.com/logstash-plugins/logstash-input-syslog/pull/78)
+
 ## 3.7.0
   - Changed the TCP reading mode to use the non-blocking method [#75](https://github.com/logstash-plugins/logstash-input-syslog/pull/75)
     It fixes the high CPU usage when TCP clients do not properly disconnect/send EOF.

data/lib/logstash/inputs/syslog.rb

@@ -83,6 +83,8 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
   # assuming users would want that (they have specific use-case for LS as syslog server).
   config :service_type, :validate => :string, :default => 'system'
 
+  GROK_FAILURE_TAG = "_grokparsefailure_sysloginput"
+
   def initialize(*params)
     super
 
@@ -103,7 +105,7 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
     @grok_filter = LogStash::Filters::Grok.new(
         "overwrite" => @syslog_field,
         "match" => { @syslog_field => @grok_pattern },
-        "tag_on_failure" => ["_grokparsefailure_sysloginput"],
+        "tag_on_failure" => [GROK_FAILURE_TAG],
         "ecs_compatibility" => ecs_compatibility # use ecs-compliant patterns
     )
 
@@ -341,10 +343,14 @@ class LogStash::Inputs::Syslog < LogStash::Inputs::Base
   def syslog_relay(event)
     @grok_filter_exec.(event)
 
-    if event.get("tags").nil? || !event.get("tags").include?(@grok_filter.tag_on_failure)
+    if event.get("tags").nil? || !event.get("tags").include?(GROK_FAILURE_TAG)
       # Per RFC3164, priority = (facility * 8) + severity
       #                       = (facility << 3) & (severity)
-      priority = event.get(@priority_key).to_i rescue 13
+      priority = if event.include?(@priority_key)
+                   event.get(@priority_key).to_i rescue 13
+                 else
+                   13
+                 end
       set_priority event, priority
 
       @date_filter_exec.(event)

data/logstash-input-syslog.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-input-syslog'
-  s.version         = '3.7.0'
+  s.version         = '3.7.1'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Reads syslog messages as events"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

data/spec/inputs/syslog_spec.rb

@@ -145,6 +145,7 @@ describe LogStash::Inputs::Syslog do
           event = LogStash::Event.new({ "message" => "hello world, this is not syslog RFC3164" })
           input.syslog_relay(event)
           expect( event.get("tags") ).to eql  ["_grokparsefailure_sysloginput"]
+          expect( event.get(priority_key) ).to eql 13
 
           syslog_event = LogStash::Event.new({ "message" => "<164>Oct 26 15:19:25 1.2.3.4 %ASA-4-106023: Deny udp src DRAC:10.1.2.3/43434" })
           input.syslog_relay(syslog_event)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-input-syslog
 version: !ruby/object:Gem::Version
-  version: 3.7.0
+  version: 3.7.1
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-10-17 00:00:00.000000000 Z
+date: 2025-03-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -20,8 +20,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.99'
   name: logstash-core-plugin-api
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -37,8 +37,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.2'
   name: logstash-mixin-ecs_compatibility_support
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -51,8 +51,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: concurrent-ruby
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -68,8 +68,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 0.1.0
   name: stud
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -85,8 +85,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: logstash-codec-plain
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -99,8 +99,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 4.4.1
   name: logstash-filter-grok
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -113,8 +113,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: logstash-filter-date
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -127,8 +127,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.3'
   name: logstash-devutils
-  prerelease: false
   type: :development
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -141,8 +141,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: logstash-codec-cef
-  prerelease: false
   type: :development
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -187,7 +187,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.33
+rubygems_version: 3.3.26
 signing_key:
 specification_version: 4
 summary: Reads syslog messages as events