Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ecs: add v8 preview with v1 implementation #76

Merged
merged 2 commits into from
Nov 10, 2021
Merged

ecs: add v8 preview with v1 implementation #76

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6ac4833
ecs: add v8 preview with v1 implementation
yaauie Nov 5, 2021
024fde2
Update CHANGELOG.md with link to PR
yaauie Nov 5, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
## Unreleased
- Fix: update to Gradle 7 [#75](https:/logstash-plugins/logstash-filter-useragent/pull/75)
## 3.3.2
- Added preview of ECS-v8 support with existing ECS-v1 implementation [#76](https:/logstash-plugins/logstash-filter-useragent/pull/76)
- Internal: update to Gradle 7 [#75](https:/logstash-plugins/logstash-filter-useragent/pull/75)

## 3.3.1
- Fix: invalid 3.3.0 release which did not package correctly [#71](https:/logstash-plugins/logstash-filter-useragent/pull/71)
Expand Down
2 changes: 1 addition & 1 deletion docs/index.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,7 +125,7 @@ filter plugins.
* Value type is <<string,string>>
* Supported values are:
** `disabled`: does not use ECS-compatible field names (fields might be set at the root of the event)
** `v1`: uses fields that are compatible with Elastic Common Schema (for example, `[user_agent][version]`)
** `v1`, `v8`: uses fields that are compatible with Elastic Common Schema (for example, `[user_agent][version]`)
* Default value depends on which version of Logstash is running:
** When Logstash provides a `pipeline.ecs_compatibility` setting, its value is used as the default
** Otherwise, the default value is `disabled`.
Expand Down
2 changes: 1 addition & 1 deletion lib/logstash/filters/useragent.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
# <https:/tobie/ua-parser/>.
class LogStash::Filters::UserAgent < LogStash::Filters::Base

include LogStash::PluginMixins::ECSCompatibilitySupport(:disabled, :v1)
include LogStash::PluginMixins::ECSCompatibilitySupport(:disabled, :v1, :v8 => :v1)

config_name "useragent"

Expand Down
2 changes: 1 addition & 1 deletion logstash-filter-useragent.gemspec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ Gem::Specification.new do |s|

# Gem dependencies
s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
s.add_runtime_dependency 'logstash-mixin-ecs_compatibility_support', '~> 1.1'
s.add_runtime_dependency 'logstash-mixin-ecs_compatibility_support', '~> 1.3'
s.add_development_dependency 'logstash-devutils'
end

16 changes: 8 additions & 8 deletions spec/filters/useragent_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
let(:event) { LogStash::Event.new('message' => message) }

context 'with target', :ecs_compatibility_support do
ecs_compatibility_matrix(:disabled, :v1) do |ecs_select|
ecs_compatibility_matrix(:disabled, :v1, :v8 => :v1) do |ecs_select|
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⛏️ the alias here is always confusing me, in the end it seems to work the same as
ecs_compatibility_matrix(:disabled, :v1, :v8)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The :v8 => :v1 powers the ecs_select#[] aliasing, so that each invocation doesn't need to supply a :v8 lookup when it is supposed to resolve to the provided v1 lookup. In this case, we don't actually rely on the provided ecs_select too much so you are right it doesn't make a difference.


let(:ecs_compatibility?) { ecs_select.active_mode != :disabled }

Expand Down Expand Up @@ -237,7 +237,7 @@
end

context "manually specified regexes file", :ecs_compatibility_support do
ecs_compatibility_matrix(:disabled, :v1) do |ecs_select|
ecs_compatibility_matrix(:disabled, :v1, :v8 => :v1) do |ecs_select|

let(:ecs_compatibility?) { ecs_select.active_mode != :disabled }

Expand Down Expand Up @@ -275,7 +275,7 @@
end

context "without target field", :ecs_compatibility_support do
ecs_compatibility_matrix(:disabled, :v1) do |ecs_select|
ecs_compatibility_matrix(:disabled, :v1, :v8 => :v1) do |ecs_select|

let(:ecs_compatibility?) { ecs_select.active_mode != :disabled }

Expand Down Expand Up @@ -310,7 +310,7 @@
end

context "nested target field", :ecs_compatibility_support do
ecs_compatibility_matrix(:disabled, :v1) do
ecs_compatibility_matrix(:disabled, :v1, :v8 => :v1) do

before(:each) do
allow_any_instance_of(described_class).to receive(:ecs_compatibility).and_return(ecs_compatibility)
Expand All @@ -337,7 +337,7 @@
end

context "without user agent", :ecs_compatibility_support do
ecs_compatibility_matrix(:disabled, :v1) do |ecs_select|
ecs_compatibility_matrix(:disabled, :v1, :v8 => :v1) do |ecs_select|

let(:ecs_compatibility?) { ecs_select.active_mode != :disabled }

Expand Down Expand Up @@ -383,7 +383,7 @@
end

context "with prefix", :ecs_compatibility_support do
ecs_compatibility_matrix(:disabled, :v1) do |ecs_select|
ecs_compatibility_matrix(:disabled, :v1, :v8 => :v1) do |ecs_select|

let(:message) { 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0' }
let(:options) { super().merge('prefix' => 'pre_') }
Expand All @@ -402,7 +402,7 @@
end if ecs_select.active_mode == :disabled

it 'warns in ECS mode (and ignores prefix)' do
expect( subject.logger ).to receive(:warn).with /Field prefix isn't supported in ECS compatibility mode/
expect( subject.logger ).to receive(:warn).with %r{Field prefix isn't supported in ECS compatibility mode}
subject.register

subject.filter(event)
Expand All @@ -416,7 +416,7 @@
end

context "no prefix", :ecs_compatibility_support do
ecs_compatibility_matrix(:disabled, :v1) do
ecs_compatibility_matrix(:disabled, :v1, :v8 => :v1) do

let(:message) { 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0' }

Expand Down
2 changes: 1 addition & 1 deletion version
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
3.3.1
3.3.2