logstash-lib 1.3.2

data/lib/logstash/inputs/wmi.rb

@@ -0,0 +1,72 @@
+# encoding: utf-8
+require "logstash/inputs/base"
+require "logstash/namespace"
+require "socket"
+
+# Collect data from WMI query
+#
+# This is useful for collecting performance metrics and other data
+# which is accessible via WMI on a Windows host
+#
+# Example:
+#
+#     input {
+#       wmi {
+#         query => "select * from Win32_Process"
+#         interval => 10
+#       }
+#       wmi {
+#         query => "select PercentProcessorTime from Win32_PerfFormattedData_PerfOS_Processor where name = '_Total'"
+#       }
+#     }
+class LogStash::Inputs::WMI < LogStash::Inputs::Base
+
+  config_name "wmi"
+  milestone 1
+
+  # WMI query
+  config :query, :validate => :string, :required => true
+  # Polling interval
+  config :interval, :validate => :number, :default => 10
+  
+  public
+  def register
+
+    @host = Socket.gethostname
+    @logger.info("Registering wmi input", :query => @query)
+
+    if RUBY_PLATFORM == "java"
+      # make use of the same fix used for the eventlog input
+      require "logstash/inputs/eventlog/racob_fix"
+      require "jruby-win32ole"
+    else
+      require "win32ole"
+    end
+  end # def register
+
+  public
+  def run(queue)
+    @wmi = WIN32OLE.connect("winmgmts://")
+    
+    begin
+      @logger.debug("Executing WMI query '#{@query}'")
+      loop do
+        @wmi.ExecQuery(@query).each do |wmiobj|
+          # create a single event for all properties in the collection
+          event = LogStash::Event.new
+          event["host"] = @host
+          decorate(event)
+          wmiobj.Properties_.each do |prop|
+            event[prop.name] = prop.value
+          end
+          queue << event
+        end
+        sleep @interval
+      end # loop
+    rescue Exception => ex
+      @logger.error("WMI query error: #{ex}\n#{ex.backtrace}")
+      sleep @interval
+      retry
+    end # begin/rescue
+  end # def run
+end # class LogStash::Inputs::WMI

data/lib/logstash/inputs/xmpp.rb

@@ -0,0 +1,81 @@
+# encoding: utf-8
+require "logstash/inputs/base"
+require "logstash/namespace"
+
+# This input allows you to receive events over XMPP/Jabber.
+#
+# This plugin can be used for accepting events from humans or applications
+# XMPP, or you can use it for PubSub or general message passing for logstash to
+# logstash.
+class LogStash::Inputs::Xmpp < LogStash::Inputs::Base
+  
+  config_name "xmpp"
+  milestone 2
+
+  default :codec, "plain"
+
+  # The user or resource ID, like foo@example.com.
+  config :user, :validate => :string, :required => :true
+
+  # The xmpp password for the user/identity.
+  config :password, :validate => :password, :required => :true
+
+  # if muc/multi-user-chat required, give the name of the room that
+  # you want to join: room@conference.domain/nick
+  config :rooms, :validate => :array
+
+  # The xmpp server to connect to. This is optional. If you omit this setting,
+  # the host on the user/identity is used. (foo.com for user@foo.com)
+  config :host, :validate => :string
+
+  # Set to true to enable greater debugging in XMPP. Useful for debugging
+  # network/authentication erros.
+  config :debug, :validate => :boolean, :default => false
+
+  public
+  def register
+    require 'xmpp4r' # xmpp4r gem
+    Jabber::debug = true if @debug
+
+    @client = Jabber::Client.new(Jabber::JID.new(@user))
+    @client.connect(@host) # it is ok if host is nil
+    @client.auth(@password.value)
+    @client.send(Jabber::Presence.new.set_type(:available))
+
+    # load the MUC Client if we are joining rooms.
+    require 'xmpp4r/muc/helper/simplemucclient' if @rooms && !@rooms.empty?
+  end # def register
+
+  public
+  def run(queue)
+    if @rooms
+      @rooms.each do |room| # handle muc messages in different rooms
+        @muc = Jabber::MUC::SimpleMUCClient.new(@client)
+        @muc.join(room)
+        @muc.on_message do |time,from,body|
+          @codec.decode(body) do |event|
+            decorate(event)
+            event["room"] = room
+            event["from"] = from
+            queue << event
+          end
+        end # @muc.on_message
+      end # @rooms.each
+    end # if @rooms
+
+    @client.add_message_callback do |msg| # handle direct/private messages
+      # accept normal msgs (skip presence updates, etc)
+      if msg.body != nil
+        @codec.decode(msg.body) do |event|
+          decorate(event)
+          # Maybe "from" should just be a hash: 
+          # { "node" => ..., "domain" => ..., "resource" => ... }
+          event["from"] = "#{msg.from.node}@#{msg.from.domain}/#{msg.from.resource}"
+          queue << event
+        end
+      end
+    end # @client.add_message_callback
+    sleep
+  end # def run
+
+end # class LogStash::Inputs::Xmpp

data/lib/logstash/inputs/zenoss.rb

@@ -0,0 +1,143 @@
+# encoding: utf-8
+require "date"
+require "logstash/inputs/rabbitmq"
+require "zlib"
+
+# Read Zenoss events from the zenoss.zenevents fanout exchange.
+#
+class LogStash::Inputs::Zenoss < LogStash::Inputs::RabbitMQ
+
+  config_name "zenoss"
+  milestone 1
+
+  # Your rabbitmq server address
+  config :host, :validate => :string, :default => "localhost"
+
+  # Your rabbitmq username
+  config :user, :validate => :string, :default => "zenoss"
+
+  # Your rabbitmq password
+  config :password, :validate => :password, :default => "zenoss"
+
+  # The name of the exchange to bind the queue. This is analogous to the 'rabbitmq
+  # output' [config 'name'](../outputs/rabbitmq)
+  config :exchange, :validate => :string, :default => "zenoss.zenevents"
+
+  # The routing key to use. This is only valid for direct or fanout exchanges
+  #
+  # * Routing keys are ignored on topic exchanges.
+  # * Wildcards are not valid on direct exchanges.
+  config :key, :validate => :string, :default => "zenoss.zenevent.#"
+
+  # The vhost to use. If you don't know what this is, leave the default.
+  config :vhost, :validate => :string, :default => "/zenoss"
+
+  def register
+    super
+    require "logstash/util/zenoss"
+    require "bunny"
+  end # def register
+
+  def run(queue)
+    begin
+      zep = Org::Zenoss::Protobufs::Zep
+
+      @logger.debug("Connecting with RabbitMQ settings #{@rabbitmq_settings.inspect}")
+      @bunny = Bunny.new(@rabbitmq_settings)
+      return if terminating?
+      @bunny.start
+      @bunny.qos({:prefetch_count => @prefetch_count})
+
+      @arguments_hash = Hash[*@arguments]
+
+      @logger.debug("Setting up queue #{@name.inspect}")
+      @queue = @bunny.queue(@name, {
+        :durable => @durable,
+        :auto_delete => @auto_delete,
+        :exclusive => @exclusive,
+        :arguments => @arguments_hash
+      })
+
+      @queue.bind(@exchange, :key => @key)
+
+      @queue.subscribe({:ack => @ack}) do |data|
+
+        # Zenoss can optionally compress message payloads.
+        if data[:header].content_encoding == "deflate"
+          data[:payload] = Zlib::Inflate.inflate(data[:payload])
+        end
+
+        # Decode the payload into an EventSummary.
+        summary = zep::EventSummary.decode(data[:payload])
+
+        # This should never happen, but skip it if it does.
+        next unless summary.occurrence.length > 0
+
+        occurrence = summary.occurrence[0]
+        #timestamp = DateTime.strptime(occurrence.created_time.to_s, "%Q").to_s
+        timestamp = Time.at(occurrence.created_time / 1000.0)
+
+        # LogStash event properties.
+        event = LogStash::Event.new(
+          "@timestamp" => timestamp,
+          "type" => @type,
+          "host" => occurrence.actor.element_title,
+          "message" => occurrence.message,
+        )
+        decorate(event)
+
+        # Direct mappings from summary.
+        %w{uuid}.each do |property|
+          property_value = occurrence.send property
+          if !property_value.nil?
+            event[property] = property_value
+          end
+        end
+
+        # Direct mappings from occurrence.
+        %w{
+          fingerprint event_class event_class_key event_key event_group agent
+          syslog_facility nt_event_code monitor
+        }.each do |property|
+          property_value = occurrence.send property
+          if !property_value.nil?
+            event[property] = property_value
+          end
+        end
+
+        # Enum Mappings.
+        event["severity"] = zep::EventSeverity.constants[occurrence.severity]
+
+        if !occurrence.status.nil?
+          event["status"] = zep::EventStatus.constants[occurrence.status]
+        end
+
+        if !occurrence.syslog_priority.nil?
+          event["syslog_priority"] = zep::SyslogPriority.constants[
+            occurrence.syslog_priority]
+        end
+
+        # Extra Details.
+        if !occurrence.details.nil?
+          occurrence.details.each do |detail|
+            if detail.value.length == 1
+              event[detail.name] = detail.value[0]
+            else
+              event[detail.name] = detail.value
+            end
+          end
+        end
+
+        queue << event
+      end # @queue.subscribe
+
+    rescue *[Bunny::ConnectionError, Bunny::ServerDownError] => e
+      @logger.error("RabbitMQ connection error, will reconnect: #{e}")
+      # Sleep for a bit before retrying.
+      # TODO(sissel): Write 'backoff' method?
+      sleep(1)
+      retry
+    end # begin/rescue
+  end # def run
+
+end # class LogStash::Inputs::Zenoss

data/lib/logstash/inputs/zeromq.rb

@@ -0,0 +1,165 @@
+# encoding: utf-8
+require "logstash/inputs/base"
+require "logstash/namespace"
+require "socket"
+
+# Read events over a 0MQ SUB socket.
+#
+# You need to have the 0mq 2.1.x library installed to be able to use
+# this input plugin.
+#
+# The default settings will create a subscriber binding to tcp://127.0.0.1:2120 
+# waiting for connecting publishers.
+#
+class LogStash::Inputs::ZeroMQ < LogStash::Inputs::Base
+
+  config_name "zeromq"
+  milestone 2
+
+  default :codec, "json"
+
+  # 0mq socket address to connect or bind
+  # Please note that `inproc://` will not work with logstash
+  # as each we use a context per thread.
+  # By default, inputs bind/listen
+  # and outputs connect
+  config :address, :validate => :array, :default => ["tcp://*:2120"]
+
+  # 0mq topology
+  # The default logstash topologies work as follows:
+  # * pushpull - inputs are pull, outputs are push
+  # * pubsub - inputs are subscribers, outputs are publishers
+  # * pair - inputs are clients, inputs are servers
+  #
+  # If the predefined topology flows don't work for you,
+  # you can change the 'mode' setting
+  # TODO (lusis) add req/rep MAYBE
+  # TODO (lusis) add router/dealer
+  config :topology, :validate => ["pushpull", "pubsub", "pair"], :required => true
+
+  # 0mq topic
+  # This is used for the 'pubsub' topology only
+  # On inputs, this allows you to filter messages by topic
+  # On outputs, this allows you to tag a message for routing
+  # NOTE: ZeroMQ does subscriber side filtering.
+  # NOTE: All topics have an implicit wildcard at the end
+  # You can specify multiple topics here
+  config :topic, :validate => :array
+
+  # mode
+  # server mode binds/listens
+  # client mode connects
+  config :mode, :validate => ["server", "client"], :default => "server"
+
+  # sender
+  # overrides the sender to 
+  # set the source of the event
+  # default is "zmq+topology://type/"
+  config :sender, :validate => :string
+
+  # 0mq socket options
+  # This exposes zmq_setsockopt
+  # for advanced tuning
+  # see http://api.zeromq.org/2-1:zmq-setsockopt for details
+  #
+  # This is where you would set values like:
+  # ZMQ::HWM - high water mark
+  # ZMQ::IDENTITY - named queues
+  # ZMQ::SWAP_SIZE - space for disk overflow
+  #
+  # example: sockopt => ["ZMQ::HWM", 50, "ZMQ::IDENTITY", "my_named_queue"]
+  config :sockopt, :validate => :hash
+
+  public
+  def register
+    require "ffi-rzmq"
+    require "logstash/util/zeromq"
+    self.class.send(:include, LogStash::Util::ZeroMQ)
+
+    case @topology
+    when "pair"
+      zmq_const = ZMQ::PAIR 
+    when "pushpull"
+      zmq_const = ZMQ::PULL
+    when "pubsub"
+      zmq_const = ZMQ::SUB
+    end # case socket_type
+    @zsocket = context.socket(zmq_const)
+    error_check(@zsocket.setsockopt(ZMQ::LINGER, 1),
+                "while setting ZMQ::LINGER == 1)")
+
+    if @sockopt
+      setopts(@zsocket, @sockopt)
+    end
+
+    @address.each do |addr|
+      setup(@zsocket, addr)
+    end
+
+    if @topology == "pubsub"
+      if @topic.nil?
+        @logger.debug("ZMQ - No topic provided. Subscribing to all messages")
+        error_check(@zsocket.setsockopt(ZMQ::SUBSCRIBE, ""),
+      "while setting ZMQ::SUBSCRIBE")
+      else
+        @topic.each do |t|
+          @logger.debug("ZMQ subscribing to topic: #{t}")
+          error_check(@zsocket.setsockopt(ZMQ::SUBSCRIBE, t),
+        "while setting ZMQ::SUBSCRIBE == #{t}")
+        end
+      end
+    end
+
+  end # def register
+
+  def teardown
+    error_check(@zsocket.close, "while closing the zmq socket")
+  end # def teardown
+
+  def server?
+    @mode == "server"
+  end # def server?
+
+  def run(output_queue)
+    host = Socket.gethostname
+    begin
+      loop do
+        # Here's the unified receiver
+        # Get the first part as the msg
+        m1 = ""
+        rc = @zsocket.recv_string(m1)
+        error_check(rc, "in recv_string")
+        @logger.debug("ZMQ receiving", :event => m1)
+        msg = m1
+        # If we have more parts, we'll eat the first as the topic
+        # and set the message to the second part
+        if @zsocket.more_parts?
+          @logger.debug("Multipart message detected. Setting @message to second part. First part was: #{m1}")
+          m2 = ''
+          rc2 = @zsocket.recv_string(m2)
+          error_check(rc2, "in recv_string")
+          @logger.debug("ZMQ receiving", :event => m2)
+          msg = m2
+        end
+
+        @codec.decode(msg) do |event|
+          event["host"] ||= host
+          decorate(event)
+          output_queue << event
+        end
+      end
+    rescue LogStash::ShutdownSignal
+      # shutdown
+      return
+    rescue => e
+      @logger.debug("ZMQ Error", :subscriber => @zsocket,
+                    :exception => e)
+      retry
+    end # begin
+  end # def run
+
+  private
+  def build_source_string
+    id = @address.first.clone
+  end
+end # class LogStash::Inputs::ZeroMQ