observed-logstash 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 5e005dcc11482579c3f276584704d1fcc079d8dc
+  data.tar.gz: a083fe5f0232256bcc4c30430741b488555bce73
+SHA512:
+  metadata.gz: 95579163f7d1ee17ab9b84992db83d19ae9c9d4ff0b1b2509fd86cecf4de1a5a7d00e6d7a54618a1b19458c2f0dc1581af341f5f08bc056327ce8e84197cf5bb
+  data.tar.gz: dd64751c5f2f269baba128f574e8a5ba4e16d78b46f32b0f809c7b9ebf858d67b3eeae745b47e27cd124e21871bad4adc60bf6f1ad6a6f8de09f78aa7f81ef6b

data/.gitignore

@@ -0,0 +1,17 @@
+*.gem
+*.rbc
+.bundle
+.config
+.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in observed-logstash.gemspec
+gemspec

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2013 GREE, Inc.
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,78 @@
+# Observed::Logstash
+
+Allows you to use the number of results returned by an Elasticsearch query as an [Observed](https://github.com/gree/observed) healthcheck.
+
+Expected use case is searching server logs stored in Logstash format.
+
+You provide an Elasticsearch query and a timespan, and the plugin will search for logs that match your query. If there are too few hits, or too many, it will record an error event.
+
+## Example use cases
+
+* If your web server returned more than X "500 Internal Server Error" responses in the last few minutes, it's probably unhealthy.
+
+* If it returned fewer than Y "200 OK" responses in the last few minutes, it's probably unhealthy.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+    gem 'observed-logstash'
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install observed-logstash
+
+## Test
+
+Some tests expect an Elasticsearch instance to be running on Localhost.
+
+    $ git clone https://github.com/cb372/observed-logstash.git
+    $ cd observed-logstash
+    $ bundle install
+    $ elasticsearch
+    $ bundle exec rspec
+
+## Usage
+
+### Configuration parameters
+
+<table>
+  <tr><th>Name</th><th>Required?</th><th>Default value</th><th>Description</th></tr>
+  <tr><td>host</td><td>No</td><td>localhost:9200</td><td>ES server hostname and port</td></tr>
+  <tr><td>index_name_format</td><td>No</td><td>logstash-%Y.%m.%d (Logstash daily format)</td><td>Naming format of ES indices</td></tr>
+  <tr><td>query</td><td>Yes</td><td></td><td>A hash representing an ES query, e.g. { :term => { :status => 404 } }</td></tr>
+  <tr><td>timespan_in_seconds</td><td>Yes</td><td></td><td>Search for logs from the last N seconds</td></tr>
+  <tr><td>max_hits</td><td>No</td><td>1000000</td><td>Maximum number of matching logs in the last N seconds. If there are more than these, an error will be recorded.</td></tr>
+  <tr><td>min_hits</td><td>No</td><td>0</td><td></td></tr>
+</table>
+
+### Example configuration
+
+````ruby
+observe 'myapp.404', via: 'logstash', with: {
+    host: 'localhost:9200',
+    index_name_format: 'observed-logstash-test-%Y.%m.%d',
+    query: { :term => { :status => 404 } },
+    timespan_in_seconds: 3600,
+    max_hits: 10
+}
+````
+
+### Example reporting
+
+````ruby
+report /myapp.404/, via: 'stdout', with: {
+    format: -> tag, time, data {
+      case data[:status]
+      when :success
+        "Looks OK! #{data[:message]}"
+      else
+        "Oh noes! #{data[:message]}"
+      end
+    }
+}
+````

data/Rakefile

@@ -0,0 +1 @@
+require "bundler/gem_tasks"

data/features/observe_404_counts_using_elasticsearch.feature

@@ -0,0 +1,31 @@
+Feature: Check the number of 404 errors using an Elasticsearch query
+
+  In order to observe the number of Apache logs with status code 404 using Observed,
+  I want to the observed-logstash plugin to perform an Elasticsearch query,
+  check the number of search results, and report the result via reporters
+
+  Scenario: Create a .rb file containing Observed code and run it with the ruby command
+    Given a file named "test.rb" with:
+    """
+    require 'observed'
+    require 'observed/logstash'
+
+    include Observed
+
+    observe 'foo_1', via: 'logstash', with: {
+      host: 'localhost:9200',
+      query: { :term => { :status => 404 } },
+      timespan_in_seconds: 60,
+      max_results: 10,
+      timeout_in_milliseconds: 1000
+    }
+
+    report /foo_\d+/, via: 'stdout'
+
+    run 'foo_1'
+    """
+    When I run `ruby test.rb`
+    Then the output should contain:
+    """
+    foo_1.success
+    """

data/features/support/env.rb

@@ -0,0 +1,8 @@
+$LOAD_PATH.unshift(File.dirname(__FILE__) + '/../../lib')
+require 'aruba/cucumber'
+
+World(Aruba::Api)
+
+Before do
+  @aruba_timeout_seconds = 20
+end

data/lib/observed/logstash.rb

@@ -0,0 +1,81 @@
+require 'observed/logstash/version'
+require 'observed/observer'
+require 'observed/observer_helpers/timer'
+require 'elasticsearch'
+
+module Observed
+  module Plugins
+    class Logstash < Observed::Observer
+
+      attribute :host, default: 'localhost:9200'
+      attribute :index_name_format, default: 'logstash-%Y.%m.%d'
+      attribute :query
+      attribute :timespan_in_seconds
+      attribute :max_hits, default: 1000000
+      attribute :min_hits, default: 0
+
+      def build_client
+        Elasticsearch::Client.new host: host
+      end
+
+      def build_timestamp_filter
+        {
+          :range => {
+            :@timestamp => {
+              :from => (system.now.to_f * 1000).to_i - (1000 * timespan_in_seconds),
+              :to => (system.now.to_f * 1000).to_i
+            }
+          }
+        }
+      end
+
+      def build_body
+        {
+          :query => query,
+          :filter => build_timestamp_filter
+        }
+      end
+
+      def build_data(hits)
+        data = { hits: hits, min_hits: min_hits, max_hits: max_hits }
+        if hits < min_hits
+          data[:status] = :error
+          data[:message] = "Not enough hits. Only #{hits} in the last #{timespan_in_seconds} seconds, required at least #{min_hits}" 
+        elsif hits > max_hits
+          data[:status] = :error
+          data[:message] = "Too many hits. Got #{hits} in the last #{timespan_in_seconds} seconds, required at most #{max_hits}" 
+        else
+          data[:status] = :success
+          data[:message] = "#{hits} hits in the last #{timespan_in_seconds} seconds" 
+        end
+
+        data
+      end
+
+      def observe
+        logger.debug "Host: #{host}, index name format: #{index_name_format}, query: [#{query}], timespan: #{timespan_in_seconds}s, max hits: #{max_hits}, min hits: #{min_hits}"
+
+        index = system.now.strftime(index_name_format)
+        body = build_body
+
+        logger.debug "Index: #{index}, Body: #{body}"
+
+        client = build_client
+        response = client.search :index => index,
+                                 :body => body
+        hits = response['hits']['total'].to_i
+        logger.debug("Hits: #{hits}")
+
+        data = build_data(hits)
+        system.report("#{self.tag}.#{data[:status]}", data)
+      end
+
+      def logger
+        @logger ||= Logger.new(STDOUT)
+      end
+
+      plugin_name 'logstash'
+
+    end
+  end
+end

data/lib/observed/logstash/version.rb

@@ -0,0 +1,5 @@
+module Observed
+  module Logstash
+    VERSION = "0.1.0"
+  end
+end

data/observed-logstash.gemspec

@@ -0,0 +1,32 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'observed/logstash/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = "observed-logstash"
+  spec.version       = Observed::Logstash::VERSION
+  spec.authors       = ["Chris Birchall"]
+  spec.email         = ["chris.birchall@gmail.com"]
+  spec.description   = %q{observed-logstash}
+  spec.summary       = %q{observed-logstash is a plugin for Observed that runs an Elasticsearch query and checks the number of results as a sign of healthiness.}
+  spec.homepage      = "https://github.com/cb372/observed-logstash"
+  spec.license       = "MIT"
+
+  spec.files         = `git ls-files`.split($/)
+  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
+  spec.require_paths = ["lib"]
+
+  spec.add_dependency "observed", "~> 0.1.0"
+  spec.add_dependency "elasticsearch", "~> 0.4.1"
+
+  spec.add_development_dependency "bundler", "~> 1.3"
+  spec.add_development_dependency "rake"
+  spec.add_development_dependency "rspec"
+  spec.add_development_dependency "mocha"
+  spec.add_development_dependency "fakefs"
+  spec.add_development_dependency "simplecov"
+  spec.add_development_dependency "cucumber"
+  spec.add_development_dependency "aruba"
+end

data/spec/fixtures/observed.conf

@@ -0,0 +1,12 @@
+require 'observed/builtin_plugins'
+require 'observed/logstash'
+
+observe 'myapp.404', via: 'logstash', with: {
+    host: 'localhost:9200',
+    index_name_format: 'observed-logstash-test-%Y.%m.%d',
+    query: { :term => { :status => 404 } },
+    timespan_in_seconds: 3600,
+    max_hits: 10
+}
+
+report /myapp.404/, via: 'stdout'

data/spec/integration_spec.rb

@@ -0,0 +1,33 @@
+require 'spec_helper'
+
+require 'observed/application/oneshot'
+require 'elasticsearch'
+
+describe Observed::Application::Oneshot do
+  subject {
+    Observed::Application::Oneshot.create(
+        config_file: 'spec/fixtures/observed.conf'
+    )
+  }
+
+  let(:index_name) {
+    Time.now.strftime('observed-logstash-test-%Y.%m.%d')
+  }
+
+  let(:client) {
+    Elasticsearch::Client.new
+  }
+
+  before do
+    client.indices.create :index => index_name
+  end
+
+  it 'initializes' do
+    expect(subject.run.size).not_to eq(0)
+  end
+
+  after do
+    client.indices.delete :index => index_name
+  end
+
+end

data/spec/logstash_spec.rb

@@ -0,0 +1,129 @@
+require 'spec_helper'
+
+require 'observed/logstash'
+require 'elasticsearch'
+
+describe Observed::Plugins::Logstash do
+
+  subject {
+    Observed::Plugins::Logstash.new
+  }
+
+  before {
+    subject.configure config
+  }
+
+  let(:config) {
+    {
+        host: 'localhost:9200',
+        index_name_format: 'apache_myapp-%Y.%m.%d',
+        query: { :term => { :status => 404 } },
+        timespan_in_seconds: 3600,
+        min_hits: 5,
+        max_hits: 10,
+        tag: 'foo',
+        system: sys
+    }
+  }
+
+  let(:sys) {
+    sys = mock('system')
+    sys.stubs(:now).returns(now)
+    sys
+  }
+
+  let(:now) {
+    Time.at(1384333117)
+  }
+
+  let(:now_millis) {
+    now.to_i * 1000
+  }
+
+  let(:one_hour_ago_millis) {
+    now_millis - (3600 * 1000)
+  }
+
+  let(:client) {
+    mock('client')
+  }
+
+  context 'when not enough hits' do
+    before {
+      client.stubs(:search).returns({ "hits" => { "total" => 4 } })
+      subject.stubs(:build_client).returns(client)
+
+      sys.expects(:report).with('foo.error', {
+        hits: 4,
+        min_hits: 5,
+        max_hits: 10,
+        status: :error, 
+        message: 'Not enough hits. Only 4 in the last 3600 seconds, required at least 5'
+      })
+    }
+
+    it 'reports an error' do
+      expect { subject.observe }.to_not raise_error
+    end
+  end
+
+  context 'when too many hits' do
+    before {
+      client.stubs(:search).returns({ "hits" => { "total" => 11 } })
+      subject.stubs(:build_client).returns(client)
+
+      sys.expects(:report).with('foo.error', {
+        hits: 11,
+        min_hits: 5,
+        max_hits: 10,
+        status: :error, 
+        message: 'Too many hits. Got 11 in the last 3600 seconds, required at most 10'
+      })
+    }
+
+    it 'reports an error' do
+      expect { subject.observe }.to_not raise_error
+    end
+  end
+
+  context 'when not too many or too few hits' do
+    before {
+      client.stubs(:search).returns({ "hits" => { "total" => 10 } })
+      subject.stubs(:build_client).returns(client)
+
+      sys.expects(:report).with('foo.success', {
+        hits: 10,
+        min_hits: 5,
+        max_hits: 10,
+        status: :success, 
+        message: '10 hits in the last 3600 seconds'
+      })
+    }
+
+    it 'reports success' do
+      expect { subject.observe }.to_not raise_error
+    end
+  end
+
+  context 'when searching' do
+    before {
+      client.stubs(:search).returns({ "hits" => { "total" => 10 } })
+      subject.stubs(:build_client).returns(client)
+    }
+
+    it 'searches the correct index and constructs query correctly' do
+      expect { client.search :index => 'apache_myapp-2013.11.13',
+                             :body => {
+                               :query => { :term => { :status => 404 } },
+                               :filter => { @timestamp => {
+                                 :from => one_hour_ago_millis,
+                                 :to => now_millis
+                                }
+                               }
+                             }
+      }
+    end
+  end
+
+
+end

data/spec/spec_helper.rb

@@ -0,0 +1,25 @@
+require 'fakefs/spec_helpers'
+require 'rspec'
+
+Dir["#{File.expand_path('..',  __FILE__)}/support/**/*.rb"].each { |f| require f }
+
+puts "Please do not update/create files while tests are running."
+
+RSpec.configure do |config|
+  config.color_enabled = true
+  config.order = :random
+  config.filter_run :focus => true
+  config.treat_symbols_as_metadata_keys_with_true_values = true
+  config.run_all_when_everything_filtered = true
+
+  config.before(:each) do
+    @fixture_path = Pathname.new(File.expand_path('../fixtures/',  __FILE__))
+  end
+
+  config.mock_framework = :mocha
+end
+
+if RUBY_VERSION =~ /^1.9/
+  require 'simplecov'
+  SimpleCov.start
+end

metadata

@@ -0,0 +1,205 @@
+--- !ruby/object:Gem::Specification
+name: observed-logstash
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Chris Birchall
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2013-11-13 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: observed
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+- !ruby/object:Gem::Dependency
+  name: elasticsearch
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.4.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.4.1
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: mocha
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: fakefs
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: cucumber
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: aruba
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+description: observed-logstash
+email:
+- chris.birchall@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- .gitignore
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- features/observe_404_counts_using_elasticsearch.feature
+- features/support/env.rb
+- lib/observed/logstash.rb
+- lib/observed/logstash/version.rb
+- observed-logstash.gemspec
+- spec/fixtures/observed.conf
+- spec/integration_spec.rb
+- spec/logstash_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/cb372/observed-logstash
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.0.3
+signing_key: 
+specification_version: 4
+summary: observed-logstash is a plugin for Observed that runs an Elasticsearch query
+  and checks the number of results as a sign of healthiness.
+test_files:
+- features/observe_404_counts_using_elasticsearch.feature
+- features/support/env.rb
+- spec/fixtures/observed.conf
+- spec/integration_spec.rb
+- spec/logstash_spec.rb
+- spec/spec_helper.rb