microsoft-sentinel-logstash-output-plugin 1.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: b1e2cf6ccbb30025280b4d8e8fd4d7d1aeaf08ab35d958f29330994c876fb715
+  data.tar.gz: 502651c1aea8fcde496e96d38abbd03ebcef59a7a8d440117b4d846ee9d08933
+SHA512:
+  metadata.gz: 43f79af90fe870588d342b92f1248b3d66ddd804735f18166381126871b85bdfb071a6d9b08ca95f78e8e0a650b3ad9f5f03bffa60c29dd34f439c4c8b5f9152
+  data.tar.gz: ff11a0adf54fd4298d201aa0db71751f635b6c56c4dda9918299b32aa95b9d4ade947a717c10c79b395e9650988b0b29c3dd839d2bb5d2941e3c56b22d8364a3

data/CHANGELOG.md

@@ -0,0 +1,2 @@
+## 1.0.0
+* Initial release for output plugin for logstash to Microsoft Sentinel. This is done with the Log Analytics DCR based API.

data/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gemspec

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE

data/README.md

@@ -0,0 +1,230 @@
+# Microsoft Sentinel output plugin for Logstash 
+
+Microsoft Sentinel provides a new output plugin for Logstash. Use this output plugin to send any log via Logstash to the Microsoft Sentinel/Log Analytics workspace. This is done with the Log Analytics DCR-based API.
+You may send logs to custom or standard tables.
+
+Plugin version: v1.0.0  
+Released on: 2022-11-14
+
+This plugin is currently in development and is free to use. We welcome contributions from the open source community on this project, and we request and appreciate feedback from users.
+
+
+## Steps to implement the output plugin
+1) Install the plugin
+2) Create a sample file
+3) Create the required DCR-related resources
+4) Configure Logstash configuration file
+5) Basic logs transmission
+
+
+## 1. Install the plugin
+
+Microsoft Sentinel provides Logstash output plugin to Log analytics workspace using DCR based logs API. 
+Install the microsoft-sentinel-logstash-output-plugin, use [Logstash Offline Plugin Management instruction](<https://www.elastic.co/guide/en/logstash/current/offline-plugins.html>). 
+
+Microsoft Sentinel's Logstash output plugin supports the following versions
+- Logstash 7 Between 7.0 and 7.17.10
+- Logstash 8 Between 8.0 and 8.8.1
+
+Please note that when using Logstash 8, it is recommended to disable ECS in the pipeline. For more information refer to [Logstash documentation.](<https://www.elastic.co/guide/en/logstash/8.4/ecs-ls.html>)
+
+
+## 2. Create a sample file
+To create a sample file, follow the following steps:
+1)	Copy the output plugin configuration below to your Logstash configuration file:
+```
+output {
+    microsoft-sentinel-logstash-output-plugin {
+        create_sample_file => true
+        sample_file_path => "<enter the path to the file in which the sample data will be written>" #for example: "c:\\temp" (for windows) or "/var/log" for Linux.
+    }
+}
+```
+Note: make sure that the path exists before creating the sample file.
+2) Start Logstash. The plugin will write up to 10 records to a sample file named "sampleFile<epoch seconds>.json" in the configured path  
+(for example: "c:\temp\sampleFile1648453501.json")
+
+
+### Configurations:
+The following parameters are optional and should be used to create a sample file.
+- **create_sample_file** - Boolean, False by default. When enabled, up to 10 events will be written to a sample json file.
+- **sample_file_path** - Number, Empty by default. Required when create_sample_file is enabled. Should include a valid path in which to place the sample file generated.
+
+### Complete example
+1. set the pipeline.conf with the following configuration:
+```
+input {
+      generator {
+        lines => [ "This is a test log message"]
+        count => 10
+      }
+}
+
+output {
+    microsoft-sentinel-logstash-output-plugin {
+        create_sample_file => true
+        sample_file_path => "<enter the path to the file in which the sample data will be written>" #for example: "c:\\temp" (for windows) or "/var/log" for Linux.
+    }
+}
+```
+
+2. the following sample file will be generated:
+```
+[
+	{
+		"host": "logstashMachine",
+		"sequence": 0,
+		"message": "This is a test log message",
+		"ls_timestamp": "2022-10-29T13:19:28.116Z",
+		"ls_version": "1"
+	},
+	...
+]
+```
+
+## 3. Create the required DCR-related resources
+To configure Microsoft Sentinel Logstash plugin you first need to create the DCR-related resources. To create these resources, follow one of the following tutorials:
+1) To ingest the data to a custom table use [Tutorial - Send custom logs to Azure Monitor Logs (preview) - Azure Monitor | Microsoft Docs](<https://docs.microsoft.com/azure/azure-monitor/logs/tutorial-custom-logs>) tutorial. Note that as part of creating the table and the DCR you will need to provide the sample file that you've created in the previous section.
+2) To ingest the data to a standard table like Syslog or CommonSecurityLog use [Tutorial - Send custom logs to Azure Monitor Logs using resource manager templates - Azure Monitor | Microsoft Docs](<https://docs.microsoft.com/azure/azure-monitor/logs/tutorial-custom-logs-api>).
+
+
+## 4. Configure Logstash configuration file
+
+Use the tutorial from the previous section to retrieve the following attributes: 
+- **client_app_Id** - String, The 'Application (client) ID' value created in step #3 of the "Configure Application" section of the tutorial you used in the previous step.
+- **client_app_secret** -String, The value of the client secret created in step #5 of the "Configure Application" section of the tutorial you used in the previous step.
+- **tenant_id** - String, Your subscription's tenant id. You can find in the following path: Home -> Azure Active Directory -> Overview Under 'Basic Information'.
+- **data_collection_endpoint** - String, - The value of the logsIngestion URI (see step #3 of the "Create data collection endpoint" section in Tutorial [Tutorial - Send custom logs to Azure Monitor Logs using resource manager templates - Azure Monitor | Microsoft Docs](<https://docs.microsoft.com/azure/azure-monitor/logs/tutorial-custom-logs-api#create-data-collection-endpoint>).
+- **dcr_immutable_id** - String, The value of the DCR immutableId (see the "Collect information from DCR" section in [Tutorial - Send custom logs to Azure Monitor Logs (preview) - Azure Monitor | Microsoft Docs](<https://docs.microsoft.com/azure/azure-monitor/logs/tutorial-custom-logs#collect-information-from-dcr>).
+- **dcr_stream_name** - String, The name of the data stream (Go to the json view of the DCR as explained in the "Collect information from DCR" section in [Tutorial - Send custom logs to Azure Monitor Logs (preview) - Azure Monitor | Microsoft Docs](<https://docs.microsoft.com/azure/azure-monitor/logs/tutorial-custom-logs#collect-information-from-dcr>) and copy the value of the "dataFlows -> streams" property (see circled in red in the below example).
+
+After retrieving the required values replace the output section of the Logstash configuration file created in the previous steps with the example below. Then, replace the strings in the brackets below with the corresponding values. Make sure you change the "create_sample_file" attribute to false.
+
+Here is an example for the output plugin configuration section:
+```
+output {
+    microsoft-sentinel-logstash-output-plugin {
+        client_app_Id => "<enter your client_app_id value here>"
+        client_app_secret => "<enter your client_app_secret value here>"
+        tenant_id => "<enter your tenant id here>"
+        data_collection_endpoint => "<enter your DCE logsIngestion URI here>"
+        dcr_immutable_id => "<enter your DCR immutableId here>"
+        dcr_stream_name => "<enter your stream name here>"
+        create_sample_file=> false
+        sample_file_path => "c:\\temp"
+    }
+}
+
+```
+### Optional configuration 
+- **key_names** – Array of strings, if you wish to send a subset of the columns to Log Analytics.
+- **plugin_flush_interval** – Number, 5 by default. Defines the maximal time difference (in seconds) between sending two messages to Log Analytics. 
+- **retransmission_time** - Number, 10 by default. This will set the amount of time in seconds given for retransmitting messages once sending has failed. 
+- **compress_data** - Boolean, false by default. When this field is true, the event data is compressed before using the API. Recommended for high throughput pipelines
+- **proxy** - String, Empty by default. Specify which proxy URL to use for all API calls.
+
+Security notice: We recommend not to implicitly state client_app_Id, client_app_secret, tenant_id, data_collection_endpoint, and dcr_immutable_id in your Logstash configuration for security reasons.
+                 It is best to store this sensitive information in a Logstash KeyStore as described here- ['Secrets Keystore'](<https://www.elastic.co/guide/en/logstash/current/keystore.html>)
+
+
+## 5. Basic logs transmission
+
+Here is an example configuration that parses Syslog incoming data into a custom stream named "Custom-MyTableRawData".
+
+### Example Configuration
+
+- Using filebeat input pipe
+
+```
+input {
+    beats {
+        port => "5044"
+    }
+}
+ filter {
+}
+output {
+    microsoft-sentinel-logstash-output-plugin {
+      client_app_Id => "619c1731-15ca-4403-9c61-xxxxxxxxxxxx"
+      client_app_secret => "xxxxxxxxxxxxxxxx"
+      tenant_id => "72f988bf-86f1-41af-91ab-xxxxxxxxxxxx"
+      data_collection_endpoint => "https://my-customlogsv2-test-jz2a.eastus2-1.ingest.monitor.azure.com"
+      dcr_immutable_id => "dcr-xxxxxxxxxxxxxxxxac23b8978251433a"
+      dcr_stream_name => "Custom-MyTableRawData"
+      proxy => "http://proxy.example.com"
+    }
+}
+
+```
+- Or using the tcp input pipe
+
+```
+input {
+    tcp {
+        port => "514"
+        type => syslog #optional, will effect log type in table
+    }
+}
+ filter {
+}
+output {
+    microsoft-sentinel-logstash-output-plugin {
+      client_app_Id => "619c1731-15ca-4403-9c61-xxxxxxxxxxxx"
+      client_app_secret => "xxxxxxxxxxxxxxxx"
+      tenant_id => "72f988bf-86f1-41af-91ab-xxxxxxxxxxxx"
+      data_collection_endpoint => "https://my-customlogsv2-test-jz2a.eastus2-1.ingest.monitor.azure.com"
+      dcr_immutable_id => "dcr-xxxxxxxxxxxxxxxxac23b8978251433a"
+      dcr_stream_name => "Custom-MyTableRawData"
+    }
+}
+```
+
+<u>Advanced Configuration</u>
+```
+input {
+  syslog {
+    port => 514
+  }
+}
+
+output {
+    microsoft-sentinel-logstash-output-plugin {
+      client_app_Id => "${CLIENT_APP_ID}"
+      client_app_secret => "${CLIENT_APP_SECRET}"
+      tenant_id => "${TENANT_ID}"
+      data_collection_endpoint => "${DATA_COLLECTION_ENDPOINT}"
+      dcr_immutable_id => "${DCR_IMMUTABLE_ID}"
+      dcr_stream_name => "Custom-MyTableRawData"
+	  key_names => ['PRI','TIME_TAG','HOSTNAME','MSG']
+    }
+}
+
+```
+
+Now you are able to run logstash with the example configuration and send mock data using the 'logger' command.
+
+For example: 
+```
+logger -p local4.warn --rfc3164 --tcp -t CEF "0|Microsoft|Device|cef-test|example|data|1|here is some more data for the example" -P 514 -d -n 127.0.0.1
+```
+
+Which will produce this content in the sample file:
+
+```
+[
+	{
+		"logsource": "logstashMachine",
+		"facility": 20,
+		"severity_label": "Warning",
+		"severity": 4,
+		"timestamp": "Apr  7 08:26:04",
+		"program": "CEF:",
+		"host": "127.0.0.1",
+		"facility_label": "local4",
+		"priority": 164,
+		"message": "0|Microsoft|Device|cef-test|example|data|1|here is some more data for the example",
+		"ls_timestamp": "2022-04-07T08:26:04.000Z",
+		"ls_version": "1"
+	}
+]
+```

data/lib/logstash/outputs/microsoft-sentinel-logstash-output-plugin.rb

@@ -0,0 +1,103 @@
+# encoding: utf-8
+require "logstash/outputs/base"
+require "logstash/namespace"
+require "logstash/sentinel/logstashLoganalyticsConfiguration"
+require "logstash/sentinel/sampleFileCreator"
+require "logstash/sentinel/logsSender"
+
+
+class LogStash::Outputs::MicrosoftSentinelOutput < LogStash::Outputs::Base
+
+  config_name "microsoft-sentinel-logstash-output-plugin"
+  
+  # Stating that the output plugin will run in concurrent mode
+  concurrency :shared
+
+  # Your registered app ID
+  config :client_app_Id, :validate => :string
+
+  # The registered app's secret, required by Azure Loganalytics REST API
+  config :client_app_secret, :validate => :string
+
+  # Your Operations Management Suite Tenant ID
+  config :tenant_id, :validate => :string
+
+  # Your data collection rule endpoint
+  config :data_collection_endpoint, :validate => :string
+
+  # Your data collection rule ID
+  config :dcr_immutable_id, :validate => :string
+
+  # Your dcr data stream name
+  config :dcr_stream_name, :validate => :string
+
+  # Subset of keys to send to the Azure Loganalytics workspace
+  config :key_names, :validate => :array, :default => []
+
+  # Max number of seconds to wait between flushes. Default 5
+  config :plugin_flush_interval, :validate => :number, :default => 5
+
+  # Factor for adding to the amount of messages sent
+  config :decrease_factor, :validate => :number, :default => 100
+
+  # This will trigger message amount resizing in a REST request to LA
+  config :amount_resizing, :validate => :boolean, :default => true
+
+  # Setting the default amount of messages sent                                                                                                    
+  # it this is set with amount_resizing=false --> each message will have max_items
+  config :max_items, :validate => :number, :default => 2000
+
+  # Setting proxy to be used for the Azure LogAnalytics REST client
+  config :proxy, :validate => :string, :default => ''
+
+  # This will set the amount of time given for retransmitting messages once sending is failed
+  config :retransmission_time, :validate => :number, :default => 10
+
+  # Compress the message body before sending to LA
+  config :compress_data, :validate => :boolean, :default => false
+
+  # Generate sample file from incoming events
+  config :create_sample_file, :validate => :boolean, :default => false
+
+  # Path where to place the sample file created
+  config :sample_file_path, :validate => :string
+
+  public
+  def register
+    @logstash_configuration= build_logstash_configuration()
+	
+    # Validate configuration correctness 
+    @logstash_configuration.validate_configuration()
+
+    @events_handler = @logstash_configuration.create_sample_file ?
+                        LogStash::Outputs::MicrosoftSentinelOutputInternal::SampleFileCreator::new(@logstash_configuration) :
+                        LogStash::Outputs::MicrosoftSentinelOutputInternal::LogsSender::new(@logstash_configuration)
+  end # def register
+
+  def multi_receive(events)
+    @events_handler.handle_events(events)
+  end # def multi_receive
+
+  def close
+    @events_handler.close
+  end
+
+  #private 
+  private
+
+  # Building the logstash object configuration from the output configuration provided by the user
+  # Return LogstashLoganalyticsOutputConfiguration populated with the configuration values
+  def build_logstash_configuration()
+    logstash_configuration= LogStash::Outputs::MicrosoftSentinelOutputInternal::LogstashLoganalyticsOutputConfiguration::new(@client_app_Id, @client_app_secret, @tenant_id, @data_collection_endpoint, @dcr_immutable_id, @dcr_stream_name, @compress_data, @create_sample_file, @sample_file_path, @logger)
+    logstash_configuration.key_names = @key_names
+    logstash_configuration.plugin_flush_interval = @plugin_flush_interval
+    logstash_configuration.decrease_factor = @decrease_factor
+    logstash_configuration.amount_resizing = @amount_resizing
+    logstash_configuration.max_items = @max_items
+    logstash_configuration.proxy = @proxy
+    logstash_configuration.retransmission_time = @retransmission_time
+
+    return logstash_configuration
+  end # def build_logstash_configuration
+
+end # class LogStash::Outputs::MicrosoftSentinelOutput

data/lib/logstash/sentinel/customSizeBasedBuffer.rb

@@ -0,0 +1,293 @@
+  # This code is from a PR for the official repo of ruby-stud
+  # with a small change to calculating the event size in the var_size function
+  # https://github.com/jordansissel/ruby-stud/pull/19
+  #
+  # @author {Alex Dean}[http://github.com/alexdean]
+  #
+  # Implements a generic framework for accepting events which are later flushed
+  # in batches. Flushing occurs whenever +:max_items+ or +:max_interval+ (seconds)
+  # has been reached or if the event size outgrows +:flush_each+ (bytes)
+  #
+  # Including class must implement +flush+, which will be called with all
+  # accumulated items either when the output buffer fills (+:max_items+ or
+  # +:flush_each+) or when a fixed amount of time (+:max_interval+) passes.
+  #
+  # == batch_receive and flush
+  # General receive/flush can be implemented in one of two ways.
+  #
+  # === batch_receive(event) / flush(events)
+  # +flush+ will receive an array of events which were passed to +buffer_receive+.
+  #
+  #   batch_receive('one')
+  #   batch_receive('two')
+  #
+  # will cause a flush invocation like
+  #
+  #   flush(['one', 'two'])
+  #
+  # === batch_receive(event, group) / flush(events, group)
+  # flush() will receive an array of events, plus a grouping key.
+  #
+  #   batch_receive('one',   :server => 'a')
+  #   batch_receive('two',   :server => 'b')
+  #   batch_receive('three', :server => 'a')
+  #   batch_receive('four',  :server => 'b')
+  #
+  # will result in the following flush calls
+  #
+  #   flush(['one', 'three'], {:server => 'a'})
+  #   flush(['two', 'four'],  {:server => 'b'})
+  #
+  # Grouping keys can be anything which are valid Hash keys. (They don't have to
+  # be hashes themselves.) Strings or Fixnums work fine. Use anything which you'd
+  # like to receive in your +flush+ method to help enable different handling for
+  # various groups of events.
+  #
+  # == on_flush_error
+  # Including class may implement +on_flush_error+, which will be called with an
+  # Exception instance whenever buffer_flush encounters an error.
+  #
+  # * +buffer_flush+ will automatically re-try failed flushes, so +on_flush_error+
+  #   should not try to implement retry behavior.
+  # * Exceptions occurring within +on_flush_error+ are not handled by
+  #   +buffer_flush+.
+  #
+  # == on_full_buffer_receive
+  # Including class may implement +on_full_buffer_receive+, which will be called
+  # whenever +buffer_receive+ is called while the buffer is full.
+  #
+  # +on_full_buffer_receive+ will receive a Hash like <code>{:pending => 30,
+  # :outgoing => 20}</code> which describes the internal state of the module at
+  # the moment.
+  #
+  # == final flush
+  # Including class should call <code>buffer_flush(:final => true)</code>
+  # during a teardown/shutdown routine (after the last call to buffer_receive)
+  # to ensure that all accumulated messages are flushed.
+  module LogStash; module Outputs; class MicrosoftSentinelOutputInternal 
+  module CustomSizeBasedBuffer
+
+    public
+    # Initialize the buffer.
+    #
+    # Call directly from your constructor if you wish to set some non-default
+    # options. Otherwise buffer_initialize will be called automatically during the
+    # first buffer_receive call.
+    #
+    # Options:
+    # * :max_items, Max number of items to buffer before flushing. Default 50.
+    # * :flush_each, Flush each bytes of buffer. Default 0 (no flushing fired by
+    #                a buffer size).
+    # * :max_interval, Max number of seconds to wait between flushes. Default 5.
+    # * :logger, A logger to write log messages to. No default. Optional.
+    #
+    # @param [Hash] options
+    def buffer_initialize(options={})
+      if ! self.class.method_defined?(:flush)
+        raise ArgumentError, "Any class including Stud::Buffer must define a flush() method."
+      end
+
+      @buffer_config = {
+        :max_items => options[:max_items] || 50,
+        :flush_each => options[:flush_each].to_i || 0,
+        :max_interval => options[:max_interval] || 5,
+        :logger => options[:logger] || nil,
+        :has_on_flush_error => self.class.method_defined?(:on_flush_error),
+        :has_on_full_buffer_receive => self.class.method_defined?(:on_full_buffer_receive)
+      }
+      @buffer_state = {
+        # items accepted from including class
+        :pending_items => {},
+        :pending_count => 0,
+        :pending_size => 0,
+
+        # guard access to pending_items & pending_count & pending_size
+        :pending_mutex => Mutex.new,
+
+        # items which are currently being flushed
+        :outgoing_items => {},
+        :outgoing_count => 0,
+        :outgoing_size => 0,
+
+        # ensure only 1 flush is operating at once
+        :flush_mutex => Mutex.new,
+
+        # data for timed flushes
+        :last_flush => Time.now.to_i,
+        :timer => Thread.new do
+          loop do
+            sleep(@buffer_config[:max_interval])
+            buffer_flush(:force => true)
+          end
+        end
+      }
+
+      # events we've accumulated
+      buffer_clear_pending
+    end
+
+    # Determine if +:max_items+ or +:flush_each+ has been reached.
+    #
+    # buffer_receive calls will block while <code>buffer_full? == true</code>.
+    #
+    # @return [bool] Is the buffer full?
+    def buffer_full?
+      (@buffer_state[:pending_count] + @buffer_state[:outgoing_count] >= @buffer_config[:max_items]) || \
+      (@buffer_config[:flush_each] != 0 && @buffer_state[:pending_size] + @buffer_state[:outgoing_size] >= @buffer_config[:flush_each])
+    end
+
+    # Save an event for later delivery
+    #
+    # Events are grouped by the (optional) group parameter you provide.
+    # Groups of events, plus the group name, are later passed to +flush+.
+    #
+    # This call will block if +:max_items+ or +:flush_each+ has been reached.
+    #
+    # @see Stud::Buffer The overview has more information on grouping and flushing.
+    #
+    # @param event An item to buffer for flushing later.
+    # @param group Optional grouping key. All events with the same key will be
+    #              passed to +flush+ together, along with the grouping key itself.
+    def buffer_receive(event, group=nil)
+      buffer_initialize if ! @buffer_state
+
+      # block if we've accumulated too many events
+      while buffer_full? do
+        on_full_buffer_receive(
+          :pending => @buffer_state[:pending_count],
+          :outgoing => @buffer_state[:outgoing_count]
+        ) if @buffer_config[:has_on_full_buffer_receive]
+        sleep 0.1
+      end
+      @buffer_state[:pending_mutex].synchronize do
+        @buffer_state[:pending_items][group] << event
+        @buffer_state[:pending_count] += 1
+        @buffer_state[:pending_size] += var_size(event) if @buffer_config[:flush_each] != 0
+      end
+
+      buffer_flush
+    end
+
+    # Try to flush events.
+    #
+    # Returns immediately if flushing is not necessary/possible at the moment:
+    # * :max_items or :flush_each have not been accumulated
+    # * :max_interval seconds have not elapased since the last flush
+    # * another flush is in progress
+    #
+    # <code>buffer_flush(:force => true)</code> will cause a flush to occur even
+    # if +:max_items+ or +:flush_each+ or +:max_interval+ have not been reached. A forced flush
+    # will still return immediately (without flushing) if another flush is
+    # currently in progress.
+    #
+    # <code>buffer_flush(:final => true)</code> is identical to <code>buffer_flush(:force => true)</code>,
+    # except that if another flush is already in progress, <code>buffer_flush(:final => true)</code>
+    # will block/wait for the other flush to finish before proceeding.
+    #
+    # @param [Hash] options Optional. May be <code>{:force => true}</code> or <code>{:final => true}</code>.
+    # @return [Fixnum] The number of items successfully passed to +flush+.
+    def buffer_flush(options={})
+      force = options[:force] || options[:final]
+      final = options[:final]
+
+      # final flush will wait for lock, so we are sure to flush out all buffered events
+      if options[:final]
+        @buffer_state[:flush_mutex].lock
+      elsif ! @buffer_state[:flush_mutex].try_lock # failed to get lock, another flush already in progress
+        return 0
+      end
+
+      items_flushed = 0
+
+      begin
+        return 0 if @buffer_state[:pending_count] == 0
+
+        # compute time_since_last_flush only when some item is pending
+        time_since_last_flush = get_time_since_last_flush
+
+        return 0 if (!force) &&
+           (@buffer_state[:pending_count] < @buffer_config[:max_items]) &&
+           (@buffer_config[:flush_each] == 0 || @buffer_state[:pending_size] < @buffer_config[:flush_each]) &&
+           (time_since_last_flush < @buffer_config[:max_interval])
+
+        @buffer_state[:pending_mutex].synchronize do
+          @buffer_state[:outgoing_items] = @buffer_state[:pending_items]
+          @buffer_state[:outgoing_count] = @buffer_state[:pending_count]
+          @buffer_state[:outgoing_size] = @buffer_state[:pending_size]
+          buffer_clear_pending
+        end
+        @buffer_config[:logger].debug("Flushing output",
+          :outgoing_count => @buffer_state[:outgoing_count],
+          :time_since_last_flush => time_since_last_flush,
+          :outgoing_events => @buffer_state[:outgoing_items],
+          :batch_timeout => @buffer_config[:max_interval],
+          :force => force,
+          :final => final
+        ) if @buffer_config[:logger]
+
+        @buffer_state[:outgoing_items].each do |group, events|
+          begin
+
+            if group.nil?
+              flush(events,final)
+            else
+              flush(events, group, final)
+            end
+
+            @buffer_state[:outgoing_items].delete(group)
+            events_size = events.size
+            @buffer_state[:outgoing_count] -= events_size
+            if @buffer_config[:flush_each] != 0
+              events_volume = 0
+              events.each do |event|
+                events_volume += var_size(event)
+              end
+              @buffer_state[:outgoing_size] -= events_volume
+            end
+            items_flushed += events_size
+
+          rescue => e
+            @buffer_config[:logger].warn("Failed to flush outgoing items",
+              :outgoing_count => @buffer_state[:outgoing_count],
+              :exception => e,
+              :backtrace => e.backtrace
+            ) if @buffer_config[:logger]
+
+            if @buffer_config[:has_on_flush_error]
+              on_flush_error e
+            end
+
+            sleep 1
+            retry
+          end
+          @buffer_state[:last_flush] = Time.now.to_i
+        end
+
+      ensure
+        @buffer_state[:flush_mutex].unlock
+      end
+
+      return items_flushed
+    end
+
+    private
+    def buffer_clear_pending
+      @buffer_state[:pending_items] = Hash.new { |h, k| h[k] = [] }
+      @buffer_state[:pending_count] = 0
+      @buffer_state[:pending_size] = 0
+    end
+
+    private
+    def var_size(var)
+        # Calculate event size as a json. 
+        # assuming event is a hash
+       return var.to_json.bytesize + 2
+    end
+
+    protected
+    def get_time_since_last_flush
+      Time.now.to_i - @buffer_state[:last_flush]
+    end    
+
+  end
+end ;end ;end