logstash-patterns-core 4.0.1 → 4.2.0

data/spec/patterns/s3_spec.rb

@@ -130,3 +130,44 @@ describe "S3_ACCESS_LOG" do
 
   end
 end
+
+describe "CLOUDFRONT_ACCESS_LOG" do
+
+  let(:pattern) { "CLOUDFRONT_ACCESS_LOG" }
+
+  context "parsing a cloudfront access log" do
+
+    let(:value) { "2016-06-10	18:41:39	IAD53	224281	192.168.1.1	GET	d27enomp470abc.cloudfront.net	/content/sample/thing.pdf	200	https://example.com/	Mozilla/5.0%2520(Windows%2520NT%25206.1;%2520WOW64)%2520AppleWebKit/537.36%2520(KHTML,%2520like%2520Gecko)%2520Chrome/51.0.2704.79%2520Safari/537.36	-	-	Miss	UGskZ6dUKY7b4C6Pt7wAWVsU2KO-vTRe-mR4r9H-WQMjhNvY6w1Xcg==	host.example.com	https	883	0.036	-	TLSv1.2	ECDHE-RSA-AES128-GCM-SHA256	Miss" }
+
+    subject { grok_match(pattern, value) }
+
+    it { should include("timestamp" => "2016-06-10	18:41:39" ) }
+    it { should include("x_edge_location" => "IAD53" ) }
+    it { should include("sc_bytes" => 224281 ) }
+    it { should include("clientip" => "192.168.1.1" ) }
+    it { should include("cs_method" =>  "GET" ) }
+    it { should include("cs_host" => "d27enomp470abc.cloudfront.net" ) }
+    it { should include("cs_uri_stem" => "/content/sample/thing.pdf" ) }
+    it { should include("sc_status" => 200 ) }
+    it { should include("referrer" => "https://example.com/" ) }
+    it { should include("agent" => "Mozilla/5.0%2520(Windows%2520NT%25206.1;%2520WOW64)%2520AppleWebKit/537.36%2520(KHTML,%2520like%2520Gecko)%2520Chrome/51.0.2704.79%2520Safari/537.36" ) }
+    it { should include("cs_uri_query" => "-" ) }
+    it { should include("cookies" => "-" ) }
+    it { should include("x_edge_result_type" => "Miss" ) }
+    it { should include("x_edge_request_id" => "UGskZ6dUKY7b4C6Pt7wAWVsU2KO-vTRe-mR4r9H-WQMjhNvY6w1Xcg==" ) }
+    it { should include("x_host_header" => "host.example.com" ) }
+    it { should include("cs_protocol" => "https" ) }
+    it { should include("cs_bytes" => 883 ) }
+    it { should include("time_taken" => 0.036 ) }
+    it { should include("x_forwarded_for" => "-" ) }
+    it { should include("ssl_protocol" => "TLSv1.2" ) }
+    it { should include("ssl_cipher" => "ECDHE-RSA-AES128-GCM-SHA256" ) }
+    it { should include("x_edge_response_result_type" => "Miss" ) }
+
+    ["tags", "params"].each do |attribute|
+      it "have #{attribute} as nil" do
+        expect(subject[attribute]).to be_nil
+      end
+    end
+  end
+end

data/spec/patterns/syslog_spec.rb

@@ -4,6 +4,20 @@ require "logstash/patterns/core"
 
 describe "SYSLOGLINE" do
 
+  describe "SYSLOG5424BASE" do
+     it "matches host names in the syslog base pattern" do
+        expect(subject).to match("<174>1 2016-11-14T09:32:44+01:00 resolver.se named 6344 - -  info: client 10.23.53.22#63252: query: googlehosted.l.googleusercontent.com IN A + (10.23.16.6)")
+     end
+     
+     it "matches ipv4 in the syslog base pattern" do
+        expect(subject).to match("<174>1 2016-11-14T09:49:23+01:00 10.23.16.6 named 2255 - -  info: client 10.23.56.93#63295 (i1.tmg.com): query: i1.tmg.com IN A + (10.23.4.13)")
+     end
+
+     it "matches ipv6 in the syslog base pattern" do
+        expect(subject).to match("<174>1 2016-11-14T09:49:23+01:00 2000:6a0:b:315:10:23:4:13 named 2255 - -  info: client 10.23.56.9#63295 (i1.tmg.com): query: i1.tmg.com IN A + (10.23.4.13)")
+     end
+   end
+
   it "matches a simple message with pid" do
     expect(subject).to match("May 11 15:17:02 meow.soy.se CRON[10973]: pam_unix(cron:session): session opened for user root by (uid=0)")
   end

data/spec/spec_helper.rb

@@ -24,15 +24,19 @@ end
 require "logstash/filters/grok"
 
 module GrokHelpers
-  def grok_match(label, message)
-    grok  = build_grok(label)
+  def grok_match(label, message, exact_match = false)
+    grok  = build_grok(label, exact_match)
     event = build_event(message)
     grok.filter(event)
     event.to_hash
   end
 
-  def build_grok(label)
-    grok = LogStash::Filters::Grok.new("match" => ["message", "%{#{label}}"])
+  def build_grok(label, exact_match = false)
+    if exact_match
+      grok = LogStash::Filters::Grok.new("match" => ["message", "^%{#{label}}$"])
+    else
+      grok = LogStash::Filters::Grok.new("match" => ["message", "%{#{label}}"])
+    end
     grok.register
     grok
   end

metadata

@@ -1,29 +1,35 @@
 --- !ruby/object:Gem::Specification
 name: logstash-patterns-core
 version: !ruby/object:Gem::Version
-  version: 4.0.1
+  version: 4.2.0
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2016-05-09 00:00:00.000000000 Z
+date: 2021-01-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.60'
+    - - "<="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.99'
   name: logstash-core-plugin-api
   prerelease: false
   type: :runtime
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.60'
+    - - "<="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.99'
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
     requirements:
@@ -52,7 +58,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program
+description: This gem is a Logstash plugin required to be installed on top of the
+  Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
+  gem is not a stand-alone program
 email: info@elastic.co
 executables: []
 extensions: []
@@ -68,14 +76,17 @@ files:
 - logstash-patterns-core.gemspec
 - patterns/aws
 - patterns/bacula
+- patterns/bind
 - patterns/bro
 - patterns/exim
 - patterns/firewalls
 - patterns/grok-patterns
 - patterns/haproxy
+- patterns/httpd
 - patterns/java
 - patterns/junos
 - patterns/linux-syslog
+- patterns/maven
 - patterns/mcollective
 - patterns/mcollective-patterns
 - patterns/mongodb
@@ -84,14 +95,18 @@ files:
 - patterns/rails
 - patterns/redis
 - patterns/ruby
+- patterns/squid
 - spec/patterns/bro.rb
 - spec/patterns/core_spec.rb
 - spec/patterns/firewalls_spec.rb
 - spec/patterns/haproxy_spec.rb
 - spec/patterns/httpd_spec.rb
+- spec/patterns/java_spec.rb
+- spec/patterns/maven_spec.rb
 - spec/patterns/mongodb_spec.rb
 - spec/patterns/nagios_spec.rb
 - spec/patterns/rails3_spec.rb
+- spec/patterns/redis_spec.rb
 - spec/patterns/s3_spec.rb
 - spec/patterns/shorewall_spec.rb
 - spec/patterns/syslog_spec.rb
@@ -117,7 +132,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project:
-rubygems_version: 2.4.8
+rubygems_version: 2.6.13
 signing_key:
 specification_version: 4
 summary: Patterns to be used in logstash
@@ -127,9 +142,12 @@ test_files:
 - spec/patterns/firewalls_spec.rb
 - spec/patterns/haproxy_spec.rb
 - spec/patterns/httpd_spec.rb
+- spec/patterns/java_spec.rb
+- spec/patterns/maven_spec.rb
 - spec/patterns/mongodb_spec.rb
 - spec/patterns/nagios_spec.rb
 - spec/patterns/rails3_spec.rb
+- spec/patterns/redis_spec.rb
 - spec/patterns/s3_spec.rb
 - spec/patterns/shorewall_spec.rb
 - spec/patterns/syslog_spec.rb