logstash-output-opsgenie 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 8e68b7e70a1bd19e7719676111e533006cfb3b9c
+  data.tar.gz: 3f7ef7b387ac48afd4816c48d56388c420c47fe3
+SHA512:
+  metadata.gz: 809699c36041fbe620f093e6432e559313ae3d0e10ddfd5d67611503ce90f5969c5119f3d4a4d88faa54516c0b2cae45581347924dc666541e45cb73bba390d0
+  data.tar.gz: dfa1e80f6c73a9a6e905b03b7e965fdf1747a9657fcdc88e5a08f35f1b8688634683e6134f8aa4adacd346c44652b1ec05e36503abffe454cd9ac7fe31f6aef2

data/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gemspec

data/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2012–2015 Elasticsearch <http://www.elastic.co>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

data/NOTICE.TXT

@@ -0,0 +1,5 @@
+Elasticsearch
+Copyright 2012-2015 Elasticsearch
+
+This product includes software developed by The Apache Software
+Foundation (http://www.apache.org/).

data/README.md

@@ -0,0 +1,86 @@
+# Logstash Plugin
+
+This is a plugin for [Logstash](https://github.com/elastic/logstash).
+
+It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.
+
+## Documentation
+
+Logstash provides infrastructure to automatically generate documentation for this plugin. We use the asciidoc format to write documentation so any comments in the source code will be first converted into asciidoc and then into html. All plugin documentation are placed under one [central location](http://www.elastic.co/guide/en/logstash/current/).
+
+- For formatting code or config example, you can use the asciidoc `[source,ruby]` directive
+- For more asciidoc formatting tips, see the excellent reference here https://github.com/elastic/docs#asciidoc-guide
+
+## Need Help?
+
+Need help? Try #logstash on freenode IRC or the https://discuss.elastic.co/c/logstash discussion forum.
+
+## Developing
+
+### 1. Plugin Developement and Testing
+
+#### Code
+- To get started, you'll need JRuby with the Bundler gem installed.
+
+- Create a new plugin or clone and existing from the GitHub [logstash-plugins](https://github.com/logstash-plugins) organization. We also provide [example plugins](https://github.com/logstash-plugins?query=example).
+
+- Install dependencies
+```sh
+bundle install
+```
+
+#### Test
+
+- Update your dependencies
+
+```sh
+bundle install
+```
+
+- Run tests
+
+```sh
+bundle exec rspec
+```
+
+### 2. Running your unpublished Plugin in Logstash
+
+#### 2.1 Run in a local Logstash clone
+
+- Edit Logstash `Gemfile` and add the local plugin path, for example:
+```ruby
+gem "logstash-filter-awesome", :path => "/your/local/logstash-filter-awesome"
+```
+- Install plugin
+```sh
+bin/plugin install --no-verify
+```
+- Run Logstash with your plugin
+```sh
+bin/logstash -e 'filter {awesome {}}'
+```
+At this point any modifications to the plugin code will be applied to this local Logstash setup. After modifying the plugin, simply rerun Logstash.
+
+#### 2.2 Run in an installed Logstash
+
+You can use the same **2.1** method to run your plugin in an installed Logstash by editing its `Gemfile` and pointing the `:path` to your local plugin development directory or you can build the gem and install it using:
+
+- Build your plugin gem
+```sh
+gem build logstash-filter-awesome.gemspec
+```
+- Install the plugin from the Logstash home
+```sh
+bin/plugin install /your/local/plugin/logstash-filter-awesome.gem
+```
+- Start Logstash and proceed to test the plugin
+
+## Contributing
+
+All contributions are welcome: ideas, patches, documentation, bug reports, complaints, and even something you drew up on a napkin.
+
+Programming is not a required skill. Whatever you've seen about open source and maintainers or community members  saying "send patches or die" - you will not see that here.
+
+It is more important to the community that you are able to contribute.
+
+For more information about contributing, see the [CONTRIBUTING](https://github.com/elastic/logstash/blob/master/CONTRIBUTING.md) file.

data/lib/logstash/outputs/opsgenie.rb

@@ -0,0 +1,223 @@
+# encoding: utf-8
+require "logstash/outputs/base"
+require "logstash/namespace"
+require 'json'
+require "uri"
+require "net/http"
+require "net/https"
+
+# The OpsGenie output is used to Create, Close, Acknowledge Alerts and Add Note to alerts in OpsGenie.
+# For this output to work, your event must contain "opsgenieAction" field and you must configure apiKey field in configuration.
+#   If opsgenieAction is "create", event must contain "message" field.
+#   For other actions ("close", "acknowledge" or "note"), event must contain "alias" or "alertId" field.
+#
+# If your event have the following fields (If you use default field names).
+#
+# Example JSON-encoded event:
+#
+#     {
+#       "message": "alert_message",
+#       "@version": "1",
+#       "@timestamp": "2015-09-22T11:20:00.250Z",
+#       "host": "192.168.1.1",
+#       "opsgenieAction": "create",
+#       "alias": "alert_alias",
+#       "teams": ["teams"],
+#       "recipients": "the-recipients",
+#       "description": "alert_description",
+#       "actions": ["actions"],
+#       "source": "alert_source",
+#       "tags": ["tags"],
+#       "entity": "alert_entity",
+#       "user": "alert_owner",
+#       "note": "additional_alert_note"
+#       "details": {
+#           "extra_prop1": "value1",
+#           "extra_prop2": "value2"
+#       }
+#     }
+#
+# An alert with following properties will be created.
+#
+#     {
+#       "message": "alert_message",
+#       "alias": "alert_alias",
+#       "teams": ["teams"],
+#       "description": "alert_description",
+#       "source": "alert_source",
+#       "tags": [
+#         "tags"
+#       ],
+#       "recipients": [
+#         "the-recipients"
+#       ],
+#       "details": {
+#         "extra_prop1": "value1",
+#         "extra_prop2": "value2"
+#       },
+#       "actions": [
+#         "actions"
+#       ],
+#       "entity": "alert_entity",
+#     }
+#
+# Fields with prefix "Attribute" are the keys of the fields will be extracted from Logstash event.
+# For more information about the api requests and their contents,
+# please refer to Alert API("https://www.opsgenie.com/docs/web-api/alert-api") support doc.
+
+class LogStash::Outputs::OpsGenie < LogStash::Outputs::Base
+
+  config_name "opsgenie"
+
+  # OpsGenie Logstash Integration API Key
+  config :apiKey, :validate => :string, :required => true
+
+  # Host of opsgenie api, normally you should not need to change this field.
+  config :opsGenieBaseUrl, :validate => :string, :required => false, :default => 'https://api.opsgenie.com'
+
+  # Url will be used to create alerts in OpsGenie
+  config :createActionUrl, :validate => :string, :required => false, :default =>'/v1/json/alert'
+
+  # Url will be used to close alerts in OpsGenie
+  config :closeActionUrl, :validate => :string, :required => false, :default =>'/v1/json/alert/close'
+
+  # Url will be used to acknowledge alerts in OpsGenie
+  config :acknowledgeActionUrl, :validate => :string, :required => false, :default =>'/v1/json/alert/acknowledge'
+
+  # Url will be used to add notes to alerts in OpsGenie
+  config :noteActionUrl, :validate => :string, :required => false, :default =>'/v1/json/alert/note'
+
+
+  # The value of this field holds the name of the action will be executed in OpsGenie.
+  # This field must be in Event object. Should be one of "create", "close", "acknowledge" or "note". Other values will be discarded.
+  config :actionAttribute, :validate => :string, :required => false, :default => 'opsgenieAction'
+
+  # The value of this field holds the Id of the alert that actions will be executed.
+  # One of "alertId" or "alias" field must be in Event object, except from "create" action
+  config :alertIdAttribute, :validate => :string, :required => false, :default => 'alertId'
+
+  # The value of this field holds the alias of the alert that actions will be executed.
+  # One of "alertId" or "alias" field must be in Event object, except from "create" action
+  config :aliasAttribute, :validate => :string, :required => false, :default => 'alias'
+
+  # The value of this field holds the alert text.
+  config :messageAttribute, :validate => :string, :required => false, :default => 'message'
+
+  # The value of this field holds the list of team names which will be responsible for the alert.
+  config :teamsAttribute, :validate => :string, :required => false, :default => 'teams'
+
+  # The value of this field holds the detailed description of the alert.
+  config :descriptionAttribute, :validate => :string, :required => false, :default => 'description'
+
+  # The value of this field holds the optional user, group, schedule or escalation names to calculate which users will receive the notifications of the alert.
+  config :recipientsAttribute, :validate => :string, :required => false, :default => 'recipients'
+
+  # The value of this field holds the comma separated list of actions that can be executed on the alert.
+  config :actionsAttribute, :validate => :string, :required => false, :default => 'actions'
+
+  # The value of this field holds the source of alert. By default, it will be assigned to IP address of incoming request.
+  config :sourceAttribute, :validate => :string, :required => false, :default => 'source'
+
+  # The value of this field holds the comma separated list of labels attached to the alert.
+  config :tagsAttribute, :validate => :string, :required => false, :default => 'tags'
+
+  # The value of this field holds the set of user defined properties. This will be specified as a nested JSON map
+  config :detailsAttribute, :validate => :string, :required => false, :default => 'details'
+
+  # The value of this field holds the entity the alert is related to.
+  config :entityAttribute, :validate => :string, :required => false, :default => 'entity'
+
+  # The value of this field holds the default owner of the execution. If user is not specified, owner of account will be used.
+  config :userAttribute, :validate => :string, :required => false, :default => 'user'
+
+  # The value of this field holds the additional alert note.
+  config :noteAttribute, :validate => :string, :required => false, :default => 'note'
+
+  public
+  def register
+  end # def register
+
+  public
+  def populateAliasOrId(event, params)
+    alertAlias = event[@aliasAttribute] if event[@aliasAttribute]
+    if alertAlias == nil then
+      alertId = event[@alertIdAttribute] if event[@alertIdAttribute]
+      if !(alertId == nil) then
+        params['alertId'] = alertId;
+      end
+    else
+      params['alias'] = alertAlias
+    end
+  end#def populateAliasOrId
+
+  public
+  def executePost(uri, params)
+    if not uri == nil then
+      @logger.info("Executing url #{uri}")
+      url = URI(uri)
+      http = Net::HTTP.new(url.host, url.port)
+      if url.scheme == 'https'
+        http.use_ssl = true
+        http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+      end
+      request = Net::HTTP::Post.new(url.path)
+      request.body = params.to_json
+      response = http.request(request)
+      body = response.body
+      body = JSON.parse(body)
+      @logger.warn("Executed [#{uri}]. Response:[#{body}]")
+    end
+  end#def executePost
+
+  public
+  def receive(event)
+    return unless output?(event)
+    @logger.info("processing #{event}")
+    opsGenieAction = event[@actionAttribute] if event[@actionAttribute]
+    if opsGenieAction then
+      params = { :apiKey => @apiKey}
+      case opsGenieAction.downcase
+      when "create"
+        uri = "#{@opsGenieBaseUrl}#{@createActionUrl}"
+        params = populateCreateAlertContent(params,event)
+      when "close"
+        uri = "#{@opsGenieBaseUrl}#{@closeActionUrl}"
+      when "acknowledge"
+        uri = "#{@opsGenieBaseUrl}#{@acknowledgeActionUrl}"
+      when "note"
+        uri = "#{@opsGenieBaseUrl}#{@noteActionUrl}"
+      else
+        @logger.warn("Action #{opsGenieAction} does not match any available action, discarding..")
+          return
+      end
+
+      populateCommonContent(params, event)
+      executePost(uri, params)
+    else
+      @logger.warn("No opsgenie action defined")
+      return
+    end
+  end # def receive
+
+  private
+  def populateCreateAlertContent(params,event)
+    params['message'] = event[@messageAttribute] if event[@messageAttribute]
+    params['teams'] = event[@teamsAttribute] if event[@teamsAttribute]
+    params['description'] = event[@descriptionAttribute] if event[@descriptionAttribute]
+    params['recipients'] = event[@recipientsAttribute] if event[@recipientsAttribute]
+    params['actions'] = event[@actionsAttribute] if event[@actionsAttribute]
+    params['tags'] = event[@tagsAttribute] if event[@tagsAttribute]
+    params['entity'] = event[@entityAttribute] if event[@entityAttribute]
+    params['details'] = event[@detailsAttribute] if event[@detailsAttribute]
+    return params
+  end
+
+  private
+  def populateCommonContent(params,event)
+    populateAliasOrId(event, params)
+    params['source'] = event[@sourceAttribute] if event[@sourceAttribute]
+    params['user'] = event[@userAttribute] if event[@userAttribute]
+    params['note'] = event[@noteAttribute] if event[@noteAttribute]
+  end
+
+end # class LogStash::Outputs::OpsGenie

data/logstash-output-opsgenie.gemspec

@@ -0,0 +1,24 @@
+Gem::Specification.new do |s|
+  s.name = 'logstash-output-opsgenie'
+  s.version         = "0.1.0"
+  s.licenses = ["Apache License (2.0)"]
+  s.summary = "This output Creates, Closes, Acknowledges alerts and Adds Note to alerts in OpsGenie."
+  s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
+  s.authors = ["Elastic"]
+  s.email = "info@elastic.co"
+  s.homepage = "http://www.elastic.co/guide/en/logstash/current/index.html"
+  s.require_paths = ["lib"]
+
+  # Files
+  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
+   # Tests
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "output" }
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core", ">= 1.4.0", "< 2.0.0"
+  s.add_runtime_dependency "logstash-codec-plain"
+  s.add_development_dependency "logstash-devutils"
+end

data/spec/outputs/opsgenie_spec.rb

@@ -0,0 +1,52 @@
+require "logstash/devutils/rspec/spec_helper"
+require "logstash/outputs/opsgenie"
+require "logstash/codecs/plain"
+require "logstash/event"
+
+describe LogStash::Outputs::OpsGenie do
+
+  subject {LogStash::Outputs::OpsGenie.new( "apiKey" => "my_api_key" )}
+  let(:logger) { subject.logger}
+
+  describe "receive message" do
+
+    it "when opsgenieAction is not specified" do
+      expect(logger).to receive(:warn).with("No opsgenie action defined").once
+      subject.receive({"message" => "test_alert","@version" => "1","@timestamp" => "2015-09-22T11:20:00.250Z"})
+    end
+
+    it "when opsgenieAction is not valid" do
+      action = "invalid"
+      expect(logger).to receive(:warn).with("Action #{action} does not match any available action, discarding..").once
+      subject.receive({"message" => "test_alert","@version" => "1","@timestamp" => "2015-09-22T11:20:00.250Z", "opsgenieAction" => action})
+    end
+
+    it "when opsGenieAction is 'create'" do
+      event = {"message" => "test_alert", "@version" => "1", "@timestamp" => "2015-09-22T11:20:00.250Z", "opsgenieAction" => "create"}
+      expect(logger).to receive(:info).with("processing #{event}").once
+      expect(logger).to receive(:info).with("Executing url #{subject.opsGenieBaseUrl}#{subject.createActionUrl}").once
+      subject.receive(event)
+    end
+
+    it "when opsGenieAction is 'close'" do
+      event = {"message" => "test_alert", "@version" => "1", "@timestamp" => "2015-09-22T11:20:00.250Z", "opsgenieAction" => "close"}
+      expect(logger).to receive(:info).with("processing #{event}").once
+      expect(logger).to receive(:info).with("Executing url #{subject.opsGenieBaseUrl}#{subject.closeActionUrl}").once
+      subject.receive(event)
+    end
+
+    it "when opsGenieAction is 'acknowledge'" do
+      event = {"message" => "test_alert", "@version" => "1", "@timestamp" => "2015-09-22T11:20:00.250Z", "opsgenieAction" => "acknowledge"}
+      expect(logger).to receive(:info).with("processing #{event}").once
+      expect(logger).to receive(:info).with("Executing url #{subject.opsGenieBaseUrl}#{subject.acknowledgeActionUrl}").once
+      subject.receive(event)
+    end
+
+    it "when opsGenieAction is 'note'" do
+      event = {"message" => "test_alert", "@version" => "1", "@timestamp" => "2015-09-22T11:20:00.250Z", "opsgenieAction" => "note"}
+      expect(logger).to receive(:info).with("processing #{event}").once
+      expect(logger).to receive(:info).with("Executing url #{subject.opsGenieBaseUrl}#{subject.noteActionUrl}").once
+      subject.receive(event)
+    end
+  end
+end

metadata

@@ -0,0 +1,102 @@
+--- !ruby/object:Gem::Specification
+name: logstash-output-opsgenie
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Elastic
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2015-09-29 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: 1.4.0
+    - - <
+      - !ruby/object:Gem::Version
+        version: 2.0.0
+  name: logstash-core
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: 1.4.0
+    - - <
+      - !ruby/object:Gem::Version
+        version: 2.0.0
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  name: logstash-codec-plain
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  name: logstash-devutils
+  prerelease: false
+  type: :development
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+description: This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program
+email: info@elastic.co
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- Gemfile
+- LICENSE
+- NOTICE.TXT
+- README.md
+- lib/logstash/outputs/opsgenie.rb
+- logstash-output-opsgenie.gemspec
+- spec/outputs/opsgenie_spec.rb
+homepage: http://www.elastic.co/guide/en/logstash/current/index.html
+licenses:
+- Apache License (2.0)
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: output
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project:
+rubygems_version: 2.4.6
+signing_key:
+specification_version: 4
+summary: This output Creates, Closes, Acknowledges alerts and Adds Note to alerts in OpsGenie.
+test_files:
+- spec/outputs/opsgenie_spec.rb