sentinelblue-logstash-output-azure-loganalytics 1.1.1 → 1.1.2.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 41e20d6292a1fe6e9b70ce0860be3f92dd47b6a90ddbb6d5ee87f7335fb30270
-  data.tar.gz: bbfd6a8f894905f0f2e2e04fdcb3daa034f04047c5f847e26817670ee8cf58f3
+  metadata.gz: 7ba5af5f1a409d3a92195e04621db3b1a94e3d316b195cd2cd22f5e8d932cc6c
+  data.tar.gz: 01fc4bc23a6e33f8ab04aeb574dd529bd22064e8b5577f27ce9dc8e548d5f103
 SHA512:
-  metadata.gz: 269d4146de6a9bdbd206f76c2d8c2563093cfb71c43a5d1660e429816d5e6577e4610987ce9b2c63f545efe385beaa1b394b0f26f7017a6ca43e9ca6e95195fa
-  data.tar.gz: 78984fe0392d030f17f1842738371c875fc7478db115fc1f0f8a42769210ce0a7e5f277aab641f63e06ab267db55b1016b6d280bcd9c21e6c2c90e887d88dc5d
+  metadata.gz: 97f2e8591b4af40cb2bb76f20be0a847d1e10d3ed005c683293a26e1b681b224e1a50d8c604266a0816afec46af81b1283251312ccc37ef33fdb6814af64864f
+  data.tar.gz: 57bbb6ca200bfd4af2d1f1049585540c4eec5c10957f3ff48a489db46c3a352849aa5369ee402ec35d4958550ef0608a842e141e7139d3775b92981ba11f652a

data/README.md

@@ -1,30 +1,35 @@
 # Sentinel Blue Azure Log Analytics output plugin for Logstash
 
-Azure Sentinel provides an output plugin for Logstash. Using this output plugin, you will be able to send any log you want using Logstash to the Azure Sentinel/Log Analytics workspace
-Today you will be able to send messages to custom logs table that you will define in the output plugin.
-[Getting started with Logstash](<https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html>)
+Sentinel Blue provides an updated output plugin for Logstash. Using this output plugin, you will be able to send any log you want using Logstash to the Azure Sentinel/Log Analytics workspace using dynamic custom table names.
+
+This allows you to set your destination table in your filtering process and reference it in the output plugin. The original plugin functionality has been preserved as well.
 
 Azure Sentinel output plugin uses the rest API integration to Log Analytics, in order to ingest the logs into custom logs tables [What are custom logs tables](<https://docs.microsoft.com/azure/azure-monitor/platform/data-sources-custom-logs>)
 
 This plugin is based on the original provided by the Azure Sentinel team. View the original plugin here: <https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/microsoft-logstash-output-azure-loganalytics>
 
 ```text
-Plugin version: v1.1.1
-Released on: 2022-10-20
+Plugin version: v1.1.2.rc1
+Released on: 2022-10-28
 ```
 
 This plugin is currently in development and is free to use. We welcome contributions from the open source community on this project, and we request and appreciate feedback from users.
 
+<https://rubygems.org/gems/sentinelblue-logstash-output-azure-loganalytics>
+
 ## Support
 
 For issues regarding the output plugin please open a support issue here. Create a new issue describing the problem so that we can assist you.
 
 ## Installation
 
-Azure Sentinel provides Logstash an output plugin to Log analytics workspace.
 Install the sentinelblue-logstash-output-azure-loganalytics, use [Logstash Working with plugins](<https://www.elastic.co/guide/en/logstash/current/working-with-plugins.html>) document.
 For offline setup follow [Logstash Offline Plugin Management instruction](<https://www.elastic.co/guide/en/logstash/current/offline-plugins.html>).
 
+```bash
+logstash-plugin install sentinelblue-logstash-output-azure-loganalytics
+```
+
 Required Logstash version: between 7.0+
 
 ## Configuration

data/VERSION

@@ -1 +1 @@
-1.1.1
+1.1.2.rc1

data/lib/logstash/logAnalyticsClient/logStashAutoResizeBuffer.rb

@@ -63,7 +63,7 @@ class LogStashAutoResizeBuffer
                 resend_message(documents_json, amount_of_documents, @logstashLoganalyticsConfiguration.retransmission_time)
             end
             rescue Exception => ex
-                @logger.error("Exception in posting data to Azure Loganalytics.\n[Exception: '#{ex}]'")
+                @logger.error("Exception in posting data to Azure Loganalytics. [Exception: '#{ex}]'")
                 @logger.trace("Exception in posting data to Azure Loganalytics.[amount_of_documents=#{amount_of_documents} documents=#{documents_json}]")
                 resend_message(documents_json, amount_of_documents, @logstashLoganalyticsConfiguration.retransmission_time)
             end
@@ -80,11 +80,11 @@ class LogStashAutoResizeBuffer
                 if is_successfully_posted(response)
                     @logger.info("Successfully sent #{amount_of_documents} logs into custom log analytics table[#{@custom_log_table_name}] after resending.")
                 else
-                    @logger.debug("Resending #{amount_of_documents} documents failed, will try to resend for #{(remaining_duration - @logstashLoganalyticsConfiguration.RETRANSMISSION_DELAY)}")
+                    @logger.debug("Resending #{amount_of_documents} documents failed (error code #{response.code}), will try to resend for #{(remaining_duration - @logstashLoganalyticsConfiguration.RETRANSMISSION_DELAY)}")
                     resend_message(documents_json, amount_of_documents, (remaining_duration - @logstashLoganalyticsConfiguration.RETRANSMISSION_DELAY))
                 end
             rescue Exception => ex
-                @logger.debug("Resending #{amount_of_documents} documents failed, will try to resend for #{(remaining_duration - @logstashLoganalyticsConfiguration.RETRANSMISSION_DELAY)}")
+                @logger.debug("Resending #{amount_of_documents} documents failed (Exception: '#{ex}'), will try to resend for #{(remaining_duration - @logstashLoganalyticsConfiguration.RETRANSMISSION_DELAY)}")
                 resend_message(documents_json, amount_of_documents, (remaining_duration - @logstashLoganalyticsConfiguration.RETRANSMISSION_DELAY))
             end
         else 

data/lib/logstash/logAnalyticsClient/logstashLoganalyticsConfiguration.rb

@@ -1,8 +1,9 @@
 # encoding: utf-8
 class LogstashLoganalyticsOutputConfiguration
-    def initialize(workspace_id, workspace_key, logger)
+    def initialize(workspace_id, workspace_key, custom_log_table_name, logger)
         @workspace_id = workspace_id
         @workspace_key = workspace_key
+        @custom_log_table_name = custom_log_table_name
         @logger = logger
 
         # Delay between each resending of a message
@@ -24,8 +25,14 @@ class LogstashLoganalyticsOutputConfiguration
         elsif @max_items < @MIN_MESSAGE_AMOUNT
             raise ArgumentError, "Setting max_items to value must be greater then #{@MIN_MESSAGE_AMOUNT}."
 
-        elsif @workspace_id.empty? or @workspace_key.empty? 
-            raise ArgumentError, "Malformed configuration , the following arguments can not be null or empty.[workspace_id=#{@workspace_id} , workspace_key=#{@workspace_key}]"
+        elsif @workspace_id.empty? or @workspace_key.empty? or @custom_log_table_name.empty?
+            raise ArgumentError, "Malformed configuration , the following arguments can not be null or empty.[workspace_id=#{@workspace_id} , workspace_key=#{@workspace_key} , custom_log_table_name=#{@custom_log_table_name}]"
+
+        elsif !@custom_log_table_name.match(/^[a-zA-Z][[:alpha:][:digit:]_]*$/) and !@custom_log_table_name.match(/^%{((\[[\w_\-@]*\])*)([\w_\-@]*)}$/)
+            raise ArgumentError, "custom_log_table_name must be either a static name starting with a letter and consisting only of numbers, letters, and underscores OR a dynamic table name of the format used by logstash (e.g. %{field_name}, %{[nested][field]}."
+
+        elsif @custom_log_table_name.match(/^[a-zA-Z][[:alpha:][:digit:]_]*$/) and @custom_log_table_name.length > 100
+            raise ArgumentError, "custom_log_table_name must not exceed 100 characters"
             
         elsif @key_names.length > 500
             raise ArgumentError, 'Azure Loganalytics limits the amount of columns to 500 in each table.' 
@@ -77,6 +84,10 @@ class LogstashLoganalyticsOutputConfiguration
         @workspace_key
     end
 
+    def custom_log_table_name
+        @custom_log_table_name
+    end
+
     def endpoint
         @endpoint
     end

data/lib/logstash/outputs/sentinelblue-logstash-output-azure-loganalytics.rb

@@ -89,7 +89,7 @@ class LogStash::Outputs::AzureLogAnalytics < LogStash::Outputs::Base
       custom_table_name = ""
 
       # Check if the table name is static or dynamic
-      if @custom_log_table_name.match(/^[[:alpha:][:digit:]_]+$/)
+      if @custom_log_table_name.match(/^[a-zA-Z][[:alpha:][:digit:]_]*$/)
         # Table name is static.
         custom_table_name = @custom_log_table_name
 
@@ -100,28 +100,26 @@ class LogStash::Outputs::AzureLogAnalytics < LogStash::Outputs::Base
 
       else
         # Incorrect format
-        @logger.warn("custom_log_table_name must be either a static name consisting only of numbers, letters, and underscores OR a dynamic table name of the format used by logstash (e.g. %{field_name}, %{[nested][field]}.")
+        @logger.error("custom_log_table_name must be either a static name consisting only of numbers, letters, and underscores OR a dynamic table name of the format used by logstash (e.g. %{field_name}, %{[nested][field]}.")
         break
 
       end
 
       # Check that the table name is a string, exists, and is les than 100 characters
-      if !custom_table_name.is_a?(String)
-        @logger.warn("The custom table name must be a string. If you used a dynamic name from one of the log fields, make sure it is a string.")
-        break
+      if !custom_table_name.match(/^[a-zA-Z][[:alpha:][:digit:]_]*$/)
+        @logger.error("The custom table name must start with a letter and only consist of letters, numbers, and/or underscores (_). Also check the field name used. If it doesn't exist, you will also receive this error.")
+        next
         
       elsif custom_table_name.empty? or custom_table_name.nil?
-        @logger.warn("The custom table name is empty. If you used a dynamic name from one of the log fields, check that it exists.")
-        break
+        @logger.error("The custom table name is empty. Make sure the field you used always returns a table name.")
+        next
 
       elsif custom_table_name.length > 100
-        @logger.warn("The custom table name must not exceed 100 characters")
-        break
+        @logger.error("The custom table name must not exceed 100 characters")
+        next
 
       end
 
-      @logger.info("Custom table name #{custom_table_name} is valid")
-
       # Determine if there is a buffer for the given table
       if buffers.keys.include?(custom_table_name)
         @logger.trace("Adding event document - " + event.to_s)
@@ -167,7 +165,7 @@ class LogStash::Outputs::AzureLogAnalytics < LogStash::Outputs::Base
   # Building the logstash object configuration from the output configuration provided by the user
   # Return LogstashLoganalyticsOutputConfiguration populated with the configuration values
   def build_logstash_configuration()
-    logstash_configuration= LogstashLoganalyticsOutputConfiguration::new(@workspace_id, @workspace_key, @logger)    
+    logstash_configuration= LogstashLoganalyticsOutputConfiguration::new(@workspace_id, @workspace_key, @custom_log_table_name, @logger)    
     logstash_configuration.endpoint = @endpoint
     logstash_configuration.time_generated_field = @time_generated_field
     logstash_configuration.key_names = @key_names

data/sentinelblue-logstash-output-azure-loganalytics.gemspec

@@ -6,7 +6,7 @@ Gem::Specification.new do |s|
   s.summary       = %q{Sentinel Blue provides a plugin outputing to Azure Sentinel for Logstash. Using this output plugin, you will be able to send any log you want using Logstash to the Azure Sentinel/Log Analytics workspace. You can utilize a dynamic table name during output to simplify complex table schemes.}
   s.description   = s.summary
   s.homepage      = "https://github.com/sentinelblue/sentinelblue-logstash-output-azure-loganalytics"
-  s.licenses      = ['Apache License (2.0)']
+  s.licenses      = ['Apache-2.0']
   s.require_paths = ["lib"]
 
   # Files

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sentinelblue-logstash-output-azure-loganalytics
 version: !ruby/object:Gem::Version
-  version: 1.1.1
+  version: 1.1.2.rc1
 platform: ruby
 authors:
 - Sentinel Blue
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-10-20 00:00:00.000000000 Z
+date: 2022-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rest-client
@@ -94,7 +94,7 @@ files:
 - spec/outputs/azure_loganalytics_spec.rb
 homepage: https://github.com/sentinelblue/sentinelblue-logstash-output-azure-loganalytics
 licenses:
-- Apache License (2.0)
+- Apache-2.0
 metadata:
   logstash_plugin: 'true'
   logstash_group: output
@@ -109,9 +109,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubygems_version: 3.3.7
 signing_key: