diff --git a/CHANGELOG b/CHANGELOG index 8e5b44923aa..7dc1bb98bc1 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -3,7 +3,7 @@ * New input plugins: generator, heroku, pipe, ganglia * New output plugins: juggernaut, metricscatcher, nagios_ncsa, pipe, opentsdb - * New filter plugins: zeromq, environment, xml, csv + * New filter plugins: zeromq, environment, xml, csv, syslog_pri * Fixes for gelf output ## IMPORTANT CHANGES FOR UPGRADES FROM 1.1.0 diff --git a/CONTRIBUTORS b/CONTRIBUTORS index dd0297d43af..6cceeeb2977 100644 --- a/CONTRIBUTORS +++ b/CONTRIBUTORS @@ -45,6 +45,7 @@ Contributors: * bodik * Philippe Weber * Marc Huffnagle (mhuffnagle) +* Oliver Gorwits (ollyg) Note: If you've sent me patches, bug reports, or other stuff for logstash, and diff --git a/lib/logstash/filters/syslog_pri.rb b/lib/logstash/filters/syslog_pri.rb index f46fa6660ed..7d94ce8d400 100644 --- a/lib/logstash/filters/syslog_pri.rb +++ b/lib/logstash/filters/syslog_pri.rb @@ -2,7 +2,8 @@ require "logstash/namespace" # Filter plugin for logstash to parse the PRI field from the front -# of a Syslog (RFC3164) message. +# of a Syslog (RFC3164) message. If no priority is set, it will +# default to 13 (per RFC). # # This filter is based on the original syslog.rb code shipped # with logstash. @@ -74,9 +75,16 @@ def filter(event) def parse_pri(event) # Per RFC3164, priority = (facility * 8) + severity # = (facility << 3) & (severity) - priority = event.fields[@syslog_pri_field_name].first.to_i rescue 13 + if event.fields[@syslog_pri_field_name] + if event.fields[@syslog_pri_field_name].is_a?(Array) + priority = event.fields[@syslog_pri_field_name].first.to_i + else + priority = event.fields[@syslog_pri_field_name].to_i + end + else + priority = 13 # default + end severity = priority & 7 # 7 is 111 (3 bits) - $stderr.puts "priority=#{priority} severity=#{severity}" facility = priority >> 3 event.fields["syslog_severity_code"] = severity event.fields["syslog_facility_code"] = facility diff --git a/test/logstash/filters/test_syslog_pri.rb b/test/logstash/filters/test_syslog_pri.rb new file mode 100644 index 00000000000..73cb2bc5964 --- /dev/null +++ b/test/logstash/filters/test_syslog_pri.rb @@ -0,0 +1,117 @@ +require "rubygems" +require File.join(File.dirname(__FILE__), "..", "minitest") + +require "logstash/loadlibs" +require "logstash" +require "logstash/filters" +require "logstash/filters/syslog_pri" +require "logstash/event" + +describe LogStash::Filters::Syslog_pri do + before do + @filter = LogStash::Filters.from_name("syslog_pri", {}) + @typename = "syslog_pri" + end + + def config(cfg) + cfg["type"] = @typename + cfg.each_key do |key| + if cfg[key].is_a?(String) + cfg[key] = [cfg[key]] + end + end + + @filter = LogStash::Filters::Syslog_pri.new(cfg) + @filter.register + end # def config + + test "severity" do + event = LogStash::Event.new + event.type = @typename + event["syslog_pri"] = 75 + @filter.filter(event) + assert_equal(3, event["syslog_severity_code"]) + end + + test "severity field name" do + event = LogStash::Event.new + event.type = @typename + event["syslog_pri"] = 75 + @filter.filter(event) + assert_equal("error", event["syslog_severity"]) + end + + test "facility" do + event = LogStash::Event.new + event.type = @typename + event["syslog_pri"] = 75 + @filter.filter(event) + assert_equal(9, event["syslog_facility_code"]) + end + + test "facility field name" do + event = LogStash::Event.new + event.type = @typename + event["syslog_pri"] = 75 + @filter.filter(event) + assert_equal("clock", event["syslog_facility"]) + end + + test "no field names added with use_labels=false" do + config "use_labels" => "false" + + event = LogStash::Event.new + event.type = @typename + event["syslog_pri"] = 75 + @filter.filter(event) + assert_equal(nil, event["syslog_facility"]) + assert_equal(nil, event["syslog_severity"]) + end + + test "default priority of 13" do + event = LogStash::Event.new + event.type = @typename + @filter.filter(event) + assert_equal(1, event["syslog_facility_code"]) + assert_equal(5, event["syslog_severity_code"]) + end + + test "priority as array" do + event = LogStash::Event.new + event.type = @typename + event["syslog_pri"] = [75] + @filter.filter(event) + assert_equal(9, event["syslog_facility_code"]) + assert_equal(3, event["syslog_severity_code"]) + end + + test "set priority field name" do + config "syslog_pri_field_name" => "syslog_pri2" + + event = LogStash::Event.new + event.type = @typename + event["syslog_pri"] = 15 + event["syslog_pri2"] = 75 + @filter.filter(event) + assert_equal(9, event["syslog_facility_code"]) + assert_equal(3, event["syslog_severity_code"]) + end + + test "custom facility labels" do + config "facility_labels" => ["a", "b", "c", "d", "e", "f"] + + event = LogStash::Event.new + event.type = @typename + @filter.filter(event) + assert_equal("b", event["syslog_facility"]) + end + + test "custom severity labels" do + config "severity_labels" => ["a", "b", "c", "d", "e", "f"] + + event = LogStash::Event.new + event.type = @typename + @filter.filter(event) + assert_equal("f", event["syslog_severity"]) + end +end # Test 'syslog_pri' filter