logstash-output-lmlogs 1.2.1 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3236f68981e8e3fb68a9335240874b9f8fb93b59372893425992f0c9c86f2895
-  data.tar.gz: 850265953883226fd2c82b3ad00acf894667aaca86396af454af6d9d59411acc
+  metadata.gz: 870bd26e9fabeb697cb8dd8f66eeb7f243b4be3fcf51c0d3babb81260a08b3d9
+  data.tar.gz: 548fff67d397ef9a6c51a2bebb0c4f44d2b3decd57faa801bd9ac2e1048edad2
 SHA512:
-  metadata.gz: 86a1e6be32d0c8f976371dd9441aa282c980a7886e4940b5e298ae28406c5f9e1934b751264a40010e7b94a307076248274c350ae87e51ce33d1b5cea1a1b57a
-  data.tar.gz: 01ca2ae8f258141614eef6312fe18c394b7602bd9e88e86c57d6f810471ee204889da918da4704c999d2942ef368925ba675df9a6bc2fb4169e842beb4fe7455
+  metadata.gz: 504cdc43d302a8d504a38627e3b914e8514331ae889dbcfba7fa3f0da6f010aeb09aa19437f5d32e73e100db4d0f839f9c182eb4135b78cfb1d538a6ea0f4314
+  data.tar.gz: 78a8b8b391c4887bfa5a06b12d044d03c9d3b9f2cfdc9231ae5a9d0a70ac28d824e59ce493cf8a4f3d2fc7675ecd0a7ce8b7d71c60fa8fc57664a7937793ad07

data/CHANGELOG.md

@@ -1,2 +1,14 @@
 ## 1.0.0
 - First version of the plugin
+## 1.0.1
+- Proxy support
+## 1.0.2
+- Update debug logs
+## 1.1.0
+- Disable mfa for gem push
+## 1.2.0
+- Add metadata by default to every log 
+## 1.2.1
+- Fix ensuring metadata exists before deleting the original while forwarding to lm-logs
+## 1.3.0
+- Add bearer token support for authentication with Logicmonitor

data/lib/logstash/outputs/lmlogs.rb

@@ -30,7 +30,7 @@ class LogStash::Outputs::LMLogs < LogStash::Outputs::Base
 
   # Keep logstash timestamp
   config :keep_timestamp, :validate => :boolean, :default => true
-  
+
   # Use a configured message key for timestamp values
   # Valid timestamp formats are ISO8601 strings or epoch in seconds, milliseconds or nanoseconds
   config :timestamp_is_key, :validate => :boolean, :default => false
@@ -91,13 +91,16 @@ class LogStash::Outputs::LMLogs < LogStash::Outputs::Base
   config :portal_name, :validate => :string, :required => true
 
   # Username to use for HTTP auth.
-  config :access_id, :validate => :string, :required => true
+  config :access_id, :validate => :string, :required => false, :default => nil
 
   # Include/Exclude metadata from sending to LM Logs
   config :include_metadata, :validate => :boolean, :default => true
 
   # Password to use for HTTP auth
-  config :access_key, :validate => :password, :required => true
+  config :access_key, :validate => :password, :required => false, :default => nil
+
+  # Use bearer token instead of access key/id for authentication.
+  config :bearer_token, :validate => :password, :required => false, :default => nil
 
   @@MAX_PAYLOAD_SIZE = 8*1024*1024
 
@@ -110,9 +113,9 @@ class LogStash::Outputs::LMLogs < LogStash::Outputs::Base
     @total_failed = 0
     logger.info("Initialized LogicMonitor output plugin with configuration",
                 :host => @host)
-    logger.info("Max Payload Size: ", 
+    logger.info("Max Payload Size: ",
                 :size => @@MAX_PAYLOAD_SIZE)
-
+    configure_auth
   end # def register
 
   def client_config
@@ -137,19 +140,7 @@ class LogStash::Outputs::LMLogs < LogStash::Outputs::Base
                       @proxy
     end
 
-    if @access_id
-      if !@access_key || !@access_key.value
-        raise ::LogStash::ConfigurationError, "access_id '#{@access_id}' specified without access_key!"
-      end
-
-      # Symbolize keys if necessary
-      # c[:auth] = {
-      #     :user => @access_id,
-      #     :password => @access_key.value,
-      #     :eager => true
-      # }
-    end
-	  log_debug("manticore client config: ", :client => c)              
+    log_debug("manticore client config: ", :client => c)
     return c
   end
 
@@ -168,21 +159,35 @@ class LogStash::Outputs::LMLogs < LogStash::Outputs::Base
     @client.close
   end
 
-
+  def configure_auth
+    @use_bearer_instead_of_lmv1 = false
+    if @access_id == nil || @access_key.value == nil
+      @logger.info "Access Id or access key null. Using bearer token for authentication."
+      @use_bearer_instead_of_lmv1 = true
+    end  
+    if @use_bearer_instead_of_lmv1 && @bearer_token.value == nil 
+      @logger.error "Bearer token not specified. Either access_id and access_key both or bearer_token must be specified for authentication with Logicmonitor."
+      raise LogStash::ConfigurationError, 'No valid authentication specified. Either access_id and access_key both or bearer_token must be specified for authentication with Logicmonitor.'
+    end
+  end  
   def generate_auth_string(body)
-    timestamp = DateTime.now.strftime('%Q')
-    hash_this = "POST#{timestamp}#{body}/log/ingest"
-    sign_this = OpenSSL::HMAC.hexdigest(
-                  OpenSSL::Digest.new('sha256'),
-                  "#{@access_key.value}",
-                  hash_this
-                )
-    signature = Base64.strict_encode64(sign_this)
-    "LMv1 #{@access_id}:#{signature}:#{timestamp}"
+    if @use_bearer_instead_of_lmv1
+      return "Bearer #{@bearer_token.value}"
+    else
+      timestamp = DateTime.now.strftime('%Q')
+      hash_this = "POST#{timestamp}#{body}/log/ingest"
+      sign_this = OpenSSL::HMAC.hexdigest(
+                    OpenSSL::Digest.new('sha256'),
+                    "#{@access_key.value}",
+                    hash_this
+                  )
+      signature = Base64.strict_encode64(sign_this)
+      return "LMv1 #{@access_id}:#{signature}:#{timestamp}"
+    end
   end
 
   def send_batch(events)
-    log_debug("Started sending logs to LM: ", 
+    log_debug("Started sending logs to LM: ",
                   :time => Time::now.utc)
     url = "https://" + @portal_name + ".logicmonitor.com/rest/log/ingest"
     body = events.to_json
@@ -249,7 +254,7 @@ class LogStash::Outputs::LMLogs < LogStash::Outputs::Base
     elsif debug
       @logger.debug(message, *opts)
     end
-  end 
+  end
 
   public
   def multi_receive(events)
@@ -268,7 +273,7 @@ class LogStash::Outputs::LMLogs < LogStash::Outputs::Base
          lmlogs_event.delete("@timestamp")  # remove redundant timestamp field
          if lmlogs_event.dig("event", "original") != nil
             lmlogs_event["event"].delete("original") # remove redundant log field
-         end 
+         end
         end
 
         lmlogs_event["message"] = event.get(@message_key).to_s
@@ -278,7 +283,7 @@ class LogStash::Outputs::LMLogs < LogStash::Outputs::Base
         if @keep_timestamp
           lmlogs_event["timestamp"] = event.get("@timestamp")
         end
-        
+
         if @timestamp_is_key
           lmlogs_event["timestamp"] = event.get(@timestamp_key.to_s)
         end
@@ -295,10 +300,10 @@ class LogStash::Outputs::LMLogs < LogStash::Outputs::Base
   end
 
   def isValidPayloadSize(documents,lmlogs_event,max_payload_size)
-    if (documents.to_json.bytesize + lmlogs_event.to_json.bytesize) >  max_payload_size 
+    if (documents.to_json.bytesize + lmlogs_event.to_json.bytesize) >  max_payload_size
           send_batch(documents)
           documents = []
-          
+
     end
     documents.push(lmlogs_event)
     return documents

data/logstash-output-lmlogs.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name = 'logstash-output-lmlogs'
-  s.version         = '1.2.1'
+  s.version         = '1.3.0'
   s.licenses = ['Apache-2.0']
   s.summary = "Logstash output plugin for LM Logs"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

data/spec/outputs/auth_spec.rb

@@ -0,0 +1,60 @@
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"
+require "logstash/outputs/lmlogs"
+require "logstash/event"
+
+describe LogStash::Outputs::LMLogs do
+
+    let(:sample_lm_logs_event){{"message" => "hello this is log 1", "_lm.resourceId" => {"test.property" => "host1"}, "timestamp" => "2021-03-22T04:28:55.907121106Z"}}
+
+    def create_output_plugin_with_conf(conf)
+        return LogStash::Outputs::LMLogs.new(conf)
+    end 
+
+    it "with no auth specified" do
+        puts "auth test"
+        plugin = create_output_plugin_with_conf({
+            "portal_name" => "localhost"
+        })
+        expect { plugin.configure_auth() }.to raise_error(LogStash::ConfigurationError)
+    end
+
+    it "access_key id is specified with no bearer" do
+        puts "auth test"
+        plugin = create_output_plugin_with_conf({
+            "portal_name" => "localhost",
+            "access_id" => "abcd",
+            "access_key" => "abcd"
+        })
+        plugin.configure_auth()
+        auth_string  = plugin.generate_auth_string([sample_lm_logs_event])
+
+        expect(auth_string).to start_with("LMv1 abcd:")
+    end
+
+    it "when access id /key not specified but bearer specified" do
+        plugin = create_output_plugin_with_conf({
+            "portal_name" => "localhost",
+            "access_id" => "abcd",
+            "bearer_token" => "abcd"
+        })
+        plugin.configure_auth()
+        auth_string  = plugin.generate_auth_string([sample_lm_logs_event])
+
+        expect(auth_string).to eq("Bearer abcd")
+    end
+
+    it "when access id /key bearer all specified, use lmv1" do
+        puts "auth test"
+        plugin = create_output_plugin_with_conf({
+            "portal_name" => "localhost",
+            "access_id" => "abcd",
+            "access_key" => "abcd",
+            "bearer_token" => "abcd"
+        })
+        plugin.configure_auth()
+        auth_string  = plugin.generate_auth_string([sample_lm_logs_event])
+
+        expect(auth_string).to start_with("LMv1 abcd:")
+    end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-output-lmlogs
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.3.0
 platform: ruby
 authors:
 - LogicMonitor
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-12-23 00:00:00.000000000 Z
+date: 2023-07-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -91,6 +91,7 @@ files:
 - README.md
 - lib/logstash/outputs/lmlogs.rb
 - logstash-output-lmlogs.gemspec
+- spec/outputs/auth_spec.rb
 - spec/outputs/lmlogs_spec.rb
 homepage: https://www.logicmonitor.com
 licenses:
@@ -119,4 +120,5 @@ signing_key:
 specification_version: 4
 summary: Logstash output plugin for LM Logs
 test_files:
+- spec/outputs/auth_spec.rb
 - spec/outputs/lmlogs_spec.rb