diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/1.2/tests/profiles/config.pan b/ncm-metaconfig/src/main/metaconfig/logstash/1.2/tests/profiles/config.pan index 2a90063327..7329769a08 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/1.2/tests/profiles/config.pan +++ b/ncm-metaconfig/src/main/metaconfig/logstash/1.2/tests/profiles/config.pan @@ -10,9 +10,8 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "custom_fields", dict("type", "remotegelf"), "host", "remotehost.domain", "sender", "myhost.domain", - ), ), -); +)); "conditionals" = append(dict( "type", "ifelseif", @@ -20,7 +19,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'httpd'", - )), + )), "plugins", list(dict("gelf", dict( "port", 12201, "sender", 'myhost.domain', @@ -28,7 +27,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "host", 'remotehost.domain', "custom_fields", dict("type", "remotegelf"), "level", list("info"), - ))), + ))), )); "conditionals" = append(dict( @@ -37,7 +36,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'remotegelf'", - )), + )), "plugins", list(dict("gelf", dict( "port", 12201, "ship_metadata", true, @@ -45,7 +44,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "custom_fields", dict("type", "remotegelf"), "level", list("%{level}"), "facility", "%{facility}", - ))), + ))), )); @@ -71,7 +70,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'remotegelf'", - )), + )), "plugins", list(dict("mutate", dict( "split", dict("tags", ", "), ))), @@ -84,21 +83,21 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'gpfs'", - )), + )), "plugins", list( dict("grok", dict( "match", list(dict( "name", "message", "pattern", list("%{GPFSLOG}"), - )), + )), "patterns_dir", list("/usr/share/grok"), "add_field", dict("program", "gpfs"), - )), + )), dict("date", dict( "match", dict( "name", "timestamp", "pattern", list("E MMM dd HH:mm:ss.SSS yyyy", "E MMM d HH:mm:ss.SSS yyyy"), - ), - )), - ), + ), + )), + ), )); diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/1.2/tests/profiles/server.pan b/ncm-metaconfig/src/main/metaconfig/logstash/1.2/tests/profiles/server.pan index 094de135c7..3925ff3c35 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/1.2/tests/profiles/server.pan +++ b/ncm-metaconfig/src/main/metaconfig/logstash/1.2/tests/profiles/server.pan @@ -22,8 +22,8 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "input/plugins" = append(dict("lumberjack", dict( "type", "lumberjack", "port", 5043, - "ssl_certificate", "/software/components/ccm/cert_file", - "ssl_key", "/software/components/ccm/key_file", + "ssl_certificate", "/etc/pki/tls/cert.pem", + "ssl_key", "/etc/pki/tls/key.pem", ))); @@ -33,7 +33,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'remotegelf'", - )), + )), "plugins", list(dict("mutate", dict( "split", dict("tags", ", "), ))), @@ -45,24 +45,24 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'syslog'", - )), + )), "plugins", list( dict("grok", dict( "match", list(dict( "name", "message", "pattern", list("%{RSYSLOGCUSTOM}"), - )), + )), "patterns_dir", list("/usr/share/grok"), "add_field", dict( "received_at", "%{@timestamp}", "received_from", "%{@source_host}", - ), - )), + ), + )), dict("kv", dict( "default_keys", dict( "key1", "value1", "key2", "value2", - ), + ), "exclude_keys", list("key1e", "key2e"), "include_keys", list("key1i", "key2i"), "prefix", "myprefix", @@ -71,33 +71,35 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "trim", "mytrim", "trimkey", "mytrimkey", "value_split", "myvaluesplit", - )), + )), dict("date", dict( "match", dict( "name", "syslog_timestamp", "pattern", list("yyyy-MM-dd'T'HH:mm:ss.SSSSSSZZ", "yyyy-MM-dd'T'HH:mm:ssZZ"), - ), - )), + ), + )), dict("mutate", dict( "exclude_tags", list("_grokparsefailure"), "replace", list( dict( "name", "@source_host", - "pattern", "%{syslog_hostname}"), + "pattern", "%{syslog_hostname}", + ), dict( "name", "@message", - "pattern", "%{syslog_message}"), + "pattern", "%{syslog_message}", ), - )), + ), + )), dict("mutate", dict( "remove_field", list("syslog_hostname", "syslog_message", "syslog_timestamp"), - )), + )), dict("bytes2human", dict( "convert", dict( "field1", "bytes", "field2", "bytes", - ), - )), + ), + )), ), )); @@ -109,6 +111,5 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "bind_host", "localhost.localdomain", "workers", 4, "port", list(9300, 9305), - ), + ), ))); - diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/1.2/tests/regexps/server/base b/ncm-metaconfig/src/main/metaconfig/logstash/1.2/tests/regexps/server/base index 46cce6faea..be757a7841 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/1.2/tests/regexps/server/base +++ b/ncm-metaconfig/src/main/metaconfig/logstash/1.2/tests/regexps/server/base @@ -15,8 +15,8 @@ input \{$ ^\s{4}\}$ ^\s{4}lumberjack \{$ ^\s{8}type => "lumberjack"$ -^\s{8}ssl_certificate => "/software/components/ccm/cert_file"$ -^\s{8}ssl_key => "/software/components/ccm/key_file"$ +^\s{8}ssl_certificate => "/etc/pki/tls/cert.pem"$ +^\s{8}ssl_key => "/etc/pki/tls/key.pem"$ ^\s{8}port => 5043$ ^\s{4}\}$ ^\}$ ### COUNT 3 diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/profiles/config.pan b/ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/profiles/config.pan index 85e3d125be..882324a68c 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/profiles/config.pan +++ b/ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/profiles/config.pan @@ -11,9 +11,8 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "custom_fields", dict("type", "remotegelf"), "host", "remotehost.domain", "sender", "myhost.domain", - ), ), -); +)); "conditionals" = append(dict( "type", "ifelseif", @@ -21,7 +20,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'httpd'", - )), + )), "plugins", list(dict("gelf", dict( "port", 12201, "sender", 'myhost.domain', @@ -29,7 +28,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "host", 'remotehost.domain', "custom_fields", dict("type", "remotegelf"), "level", list("info"), - ))), + ))), )); "conditionals" = append(dict( @@ -38,7 +37,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'remotegelf'", - )), + )), "plugins", list(dict("gelf", dict( "port", 12201, "ship_metadata", true, @@ -46,7 +45,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "custom_fields", dict("type", "remotegelf"), "level", list("%{level}"), "facility", "%{facility}", - ))), + ))), )); @@ -72,7 +71,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'remotegelf'", - )), + )), "plugins", list(dict("mutate", dict( "split", dict("tags", ", "), ))), @@ -85,35 +84,35 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'gpfs'", - )), + )), "plugins", list( dict("grok", dict( "match", list(dict( "name", "message", "pattern", list("%{GPFSLOG}"), - )), + )), "patterns_dir", list("/usr/share/grok"), "add_field", dict("program", "gpfs"), - )), + )), dict('drop', dict( "_conditional", dict("expr", list(dict( "left", "[sometag]", "test", "!~", "right", "'^SOME_STRING'", - ))), + ))), "percentage", 80, "periodic_flush", true, - )), + )), dict('drop', dict("_conditional", dict("expr", list(dict( "left", "[someothertag]", "test", "=~", "right", "'^SOME_OTHERSTRING'", - ))))), + ))))), dict("date", dict( "match", dict( "name", "timestamp", "pattern", list("E MMM dd HH:mm:ss.SSS yyyy", "E MMM d HH:mm:ss.SSS yyyy"), - ), - )), - ), + ), + )), + ), )); diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/profiles/server.pan b/ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/profiles/server.pan index e3805e4f34..e701d8f211 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/profiles/server.pan +++ b/ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/profiles/server.pan @@ -22,15 +22,15 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "input/plugins" = append(dict("lumberjack", dict( "type", "lumberjack", "port", 5043, - "ssl_certificate", "/software/components/ccm/cert_file", - "ssl_key", "/software/components/ccm/key_file", + "ssl_certificate", "/etc/pki/tls/cert.pem", + "ssl_key", "/etc/pki/tls/key.pem", ))); "input/plugins" = append(dict("beats", dict( "type", "beats", "port", 5043, - "ssl_certificate", "/software/components/ccm/cert_file", - "ssl_key", "/software/components/ccm/key_file", + "ssl_certificate", "/etc/pki/tls/cert.pem", + "ssl_key", "/etc/pki/tls/key.pem", "ssl", true, "congestion_threshold", 20, ))); @@ -41,7 +41,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'remotegelf'", - )), + )), "plugins", list(dict("mutate", dict( "split", dict("tags", ", "), ))), @@ -53,24 +53,24 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'syslog'", - )), + )), "plugins", list( dict("grok", dict( "match", list(dict( "name", "message", "pattern", list("%{RSYSLOGCUSTOM}", "%{OTHERPATTERN}"), - )), + )), "patterns_dir", list("/usr/share/grok"), "add_field", dict( "received_at", "%{@timestamp}", "received_from", "%{@source_host}", - ), - )), + ), + )), dict("kv", dict( "default_keys", dict( "key1", "value1", "key2", "value2", - ), + ), "exclude_keys", list("key1e", "key2e"), "include_keys", list("key1i", "key2i"), "prefix", "myprefix", @@ -79,31 +79,33 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "trim", "mytrim", "trimkey", "mytrimkey", "value_split", "myvaluesplit", - )), + )), dict("date", dict( "match", dict( "name", "syslog_timestamp", "pattern", list("yyyy-MM-dd'T'HH:mm:ss.SSSSSSZZ", "yyyy-MM-dd'T'HH:mm:ssZZ"), - ), - )), + ), + )), dict("mutate", dict( "_conditional", dict('expr', list(dict( "left", "'_grokparsefailure'", "test", "not in", "right", "[tags]", - ))), + ))), "replace", list( dict( "name", "@source_host", - "pattern", "%{syslog_hostname}"), + "pattern", "%{syslog_hostname}", + ), dict( "name", "@message", - "pattern", "%{syslog_message}"), + "pattern", "%{syslog_message}", ), - )), + ), + )), dict("mutate", dict( "remove_field", list("syslog_hostname", "syslog_message", "syslog_timestamp"), - )), + )), dict("mutate", dict( "_conditional", dict('expr', list( dict( @@ -114,32 +116,33 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. dict( "join", "and", "left", "[jube_id]", - ))), - "convert", dict( - "success", "boolean" ), )), + "convert", dict( + "success", "boolean" + ), + )), dict("mutate", dict( "add_field", dict( escape("[@metadata][target_index]"), "longterm-%{+YYYY.MM.dd}", - ), - )), + ), + )), dict("mutate", dict( "_conditional", dict("expr", list(dict( "left", "[program]", "test", "==", "right", "\"jube\"", - ))), + ))), "update", dict( escape("[@metadata][target_index]"), "longterm-%{+YYYY.Q}", - ), - )), + ), + )), dict("bytes2human", dict( "convert", dict( "field1", "bytes", "field2", "bytes", - ), - )), + ), + )), ), )); @@ -150,5 +153,5 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "hosts", list("localhost.localdomain:9200"), "workers", 4, "template_overwrite", true, - ), + ), ))); diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/regexps/server/base b/ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/regexps/server/base index e9732c7912..171236b7b5 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/regexps/server/base +++ b/ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/regexps/server/base @@ -15,14 +15,14 @@ input \{$ ^\s{4}\}$ ^\s{4}lumberjack \{$ ^\s{8}type => "lumberjack"$ -^\s{8}ssl_certificate => "/software/components/ccm/cert_file"$ -^\s{8}ssl_key => "/software/components/ccm/key_file"$ +^\s{8}ssl_certificate => "/etc/pki/tls/cert.pem"$ +^\s{8}ssl_key => "/etc/pki/tls/key.pem"$ ^\s{8}port => 5043$ ^\s{4}\}$ ^\s{4}beats \{$ ^\s{8}type => "beats"$ -^\s{8}ssl_certificate => "/software/components/ccm/cert_file"$ -^\s{8}ssl_key => "/software/components/ccm/key_file"$ +^\s{8}ssl_certificate => "/etc/pki/tls/cert.pem"$ +^\s{8}ssl_key => "/etc/pki/tls/key.pem"$ ^\s{8}port => 5043$ ^\s{8}ssl => true$ ^\s{8}congestion_threshold => 20$ diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/5.0/tests/profiles/config.pan b/ncm-metaconfig/src/main/metaconfig/logstash/5.0/tests/profiles/config.pan index e15c742c7a..09f76c31eb 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/5.0/tests/profiles/config.pan +++ b/ncm-metaconfig/src/main/metaconfig/logstash/5.0/tests/profiles/config.pan @@ -11,9 +11,8 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "custom_fields", dict("type", "remotegelf"), "host", "remotehost.domain", "sender", "myhost.domain", - ), ), -); +)); "conditionals" = append(dict( "type", "ifelseif", @@ -21,7 +20,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'httpd'", - )), + )), "plugins", list(dict("gelf", dict( "port", 12201, "sender", 'myhost.domain', @@ -29,7 +28,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "host", 'remotehost.domain', "custom_fields", dict("type", "remotegelf"), "level", list("info"), - ))), + ))), )); "conditionals" = append(dict( @@ -38,7 +37,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'remotegelf'", - )), + )), "plugins", list(dict("gelf", dict( "port", 12201, "ship_metadata", true, @@ -46,7 +45,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "custom_fields", dict("type", "remotegelf"), "level", list("%{level}"), "facility", "%{facility}", - ))), + ))), )); @@ -72,7 +71,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'remotegelf'", - )), + )), "plugins", list(dict("mutate", dict( "split", dict("tags", ", "), ))), @@ -85,35 +84,35 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'gpfs'", - )), + )), "plugins", list( dict("grok", dict( "match", list(dict( "name", "message", "pattern", list("%{GPFSLOG}"), - )), + )), "patterns_dir", list("/usr/share/grok"), "add_field", dict("program", "gpfs"), - )), + )), dict('drop', dict( "_conditional", dict("expr", list(dict( "left", "[sometag]", "test", "!~", "right", "'^SOME_STRING'", - ))), + ))), "percentage", 80, "periodic_flush", true, - )), + )), dict('drop', dict("_conditional", dict("expr", list(dict( "left", "[someothertag]", "test", "=~", "right", "'^SOME_OTHERSTRING'", - ))))), + ))))), dict("date", dict( "match", dict( "name", "timestamp", "pattern", list("E MMM dd HH:mm:ss.SSS yyyy", "E MMM d HH:mm:ss.SSS yyyy"), - ), - )), - ), + ), + )), + ), )); diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/5.0/tests/profiles/server.pan b/ncm-metaconfig/src/main/metaconfig/logstash/5.0/tests/profiles/server.pan index b7c2116359..e251a73d44 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/5.0/tests/profiles/server.pan +++ b/ncm-metaconfig/src/main/metaconfig/logstash/5.0/tests/profiles/server.pan @@ -48,7 +48,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'remotegelf'", - )), + )), "plugins", list(dict("mutate", dict( "split", dict("tags", ", "), ))), @@ -60,43 +60,45 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'syslog'", - )), + )), "plugins", list( dict("grok", dict( "match", list(dict( "name", "message", "pattern", SYSLOG_GROK_PATTERNS, - )), + )), "patterns_dir", list("/usr/share/grok"), "add_field", dict( "received_at", "%{@timestamp}", "received_from", "%{@source_host}", - ), - )), + ), + )), dict("kv", dict( "source", "KEY_EQ_VALUEDATA", - )), + )), dict("date", dict( "match", dict( "name", "syslog_timestamp", "pattern", list("yyyy-MM-dd'T'HH:mm:ss.SSSSSSZZ", "yyyy-MM-dd'T'HH:mm:ssZZ"), - ), - )), + ), + )), dict("mutate", dict( "_conditional", dict('expr', list(dict( "left", "'_grokparsefailure'", "test", "not in", "right", "[tags]", - ))), + ))), "replace", list( dict( "name", "@source_host", - "pattern", "%{syslog_hostname}"), + "pattern", "%{syslog_hostname}", + ), dict( "name", "@message", - "pattern", "%{syslog_message}"), + "pattern", "%{syslog_message}", ), - )), + ), + )), dict("mutate", dict( "_conditional", dict('expr', list( dict( @@ -107,15 +109,15 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. dict( "join", "and", "left", "[jube_id]", - ))), + ), + )), "convert", dict( - "success", "boolean", - ) - ), - ), + "success", "boolean", + ) + )), dict("mutate", dict( "remove_field", list("syslog_hostname", "syslog_message", "syslog_timestamp"), - )), + )), dict("bytes2human", dict( "convert", dict( "volumedata", "bytes", @@ -125,26 +127,26 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "objrecovthr", "bytes", "actwrite", "bytes", "actread", "bytes", - ), - )), + ), + )), dict("mutate", dict( "_conditional", dict("expr", list(dict( "left", "[program]", "test", "==", "right", "\"jube\"", - ))), + ))), "update", dict(escape("[@metadata][target_index]"), "longterm-%{+YYYY}"), - )), - ), - ) -); + )), + ), +)); "filter/plugins" = append(dict( - "mutate", dict( - "add_field", dict( - escape("[@metadata][target_index]"), "logstash-%{+YYYY.MM.dd}" - ), - ))); + "mutate", dict( + "add_field", dict( + escape("[@metadata][target_index]"), "logstash-%{+YYYY.MM.dd}" + ), + ), +)); "filter/conditionals" = append(dict( @@ -153,13 +155,13 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[program]", "test", "==", "right", "'gpfsbeat'", - )), + )), "plugins", list( dict("mutate", dict( "update", dict(escape("[@metadata][target_index]"), "longterm-%{+YYYY}"), )), ), - )); +)); # reset the output, to remove the GELF output "output" = dict("plugins", list(dict( @@ -168,7 +170,6 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "hosts", list("localhost:9200"), "template_overwrite", true, "index", "%{[@metadata][target_index]}", - ), + ), ))); - diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/7.0/tests/profiles/config.pan b/ncm-metaconfig/src/main/metaconfig/logstash/7.0/tests/profiles/config.pan index 8032d84701..90daddf79c 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/7.0/tests/profiles/config.pan +++ b/ncm-metaconfig/src/main/metaconfig/logstash/7.0/tests/profiles/config.pan @@ -6,11 +6,12 @@ include 'metaconfig/logstash/config'; prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash.conf}/contents/output"; -"plugins" = list(dict( - "gelf", dict( - "custom_fields", dict("type", "remotegelf"), - "host", "remotehost.domain", - "sender", "myhost.domain", +"plugins" = list( + dict( + "gelf", dict( + "custom_fields", dict("type", "remotegelf"), + "host", "remotehost.domain", + "sender", "myhost.domain", ), ), dict( @@ -24,103 +25,129 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "conditionals" = append(dict( "type", "ifelseif", - "expr", list(dict( - "left", "[type]", - "test", "==", - "right", "'httpd'", - )), - "plugins", list(dict("gelf", dict( - "port", 12201, - "sender", 'myhost.domain', - "ship_metadata", true, - "host", 'remotehost.domain', - "custom_fields", dict("type", "remotegelf"), - "level", list("info"), - ))), + "expr", list( + dict( + "left", "[type]", + "test", "==", + "right", "'httpd'", + ), + ), + "plugins", list( + dict( + "gelf", dict( + "port", 12201, + "sender", 'myhost.domain', + "ship_metadata", true, + "host", 'remotehost.domain', + "custom_fields", dict("type", "remotegelf"), + "level", list("info"), + ), + ), + ), )); "conditionals" = append(dict( "type", "ifelseif", - "expr", list(dict( - "left", "[type]", - "test", "==", - "right", "'remotegelf'", - )), - "plugins", list(dict("gelf", dict( - "port", 12201, - "ship_metadata", true, - "host", 'remotehost.domain', - "custom_fields", dict("type", "remotegelf"), - "level", list("%{level}"), - "facility", "%{facility}", - ))), + "expr", list( + dict( + "left", "[type]", + "test", "==", + "right", "'remotegelf'", + ), + ), + "plugins", list( + dict( + "gelf", dict( + "port", 12201, + "ship_metadata", true, + "host", 'remotehost.domain', + "custom_fields", dict("type", "remotegelf"), + "level", list("%{level}"), + "facility", "%{facility}", + ), + ), + ), )); prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash.conf}/contents/input"; -"plugins" = append(dict("gelf", dict( - # type is/can be set in output gelf filter. - # this will not forcefully overwrtie in 1.2.2 - "type", "remotegelf", - "port", 12201, -))); +"plugins" = append(dict( + "gelf", dict( + # type is/can be set in output gelf filter. + # this will not forcefully overwrtie in 1.2.2 + "type", "remotegelf", + "port", 12201, + ), +)); -"plugins" = append(dict("file", dict( - "path", list("/var/adm/ras/mmfs.log.latest"), - "type", "gpfs", - "tags", list("gpfs", "storage"), -))); +"plugins" = append(dict( + "file", dict( + "path", list("/var/adm/ras/mmfs.log.latest"), + "type", "gpfs", + "tags", list("gpfs", "storage"), + ), +)); prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash.conf}/contents/filter"; "conditionals" = append(dict( "type", "ifelseif", - "expr", list(dict( - "left", "[type]", - "test", "==", - "right", "'remotegelf'", - )), - "plugins", list(dict("mutate", dict( - "split", dict("tags", ", "), - ))), + "expr", list( + dict( + "left", "[type]", + "test", "==", + "right", "'remotegelf'", + ), + ), + "plugins", list( + dict( + "mutate", dict( + "split", dict("tags", ", "), + ), + ), + ), )); "conditionals" = append(dict( "type", "ifelseif", - "expr", list(dict( - "left", "[type]", - "test", "==", - "right", "'gpfs'", - )), + "expr", list( + dict( + "left", "[type]", + "test", "==", + "right", "'gpfs'", + ), + ), "plugins", list( dict("grok", dict( - "match", list(dict( - "name", "message", - "pattern", list("%{GPFSLOG}"), - )), + "match", list( + dict( + "name", "message", + "pattern", list("%{GPFSLOG}"), + ), + ), "patterns_dir", list("/usr/share/grok"), "add_field", dict("program", "gpfs"), - )), + )), dict('drop', dict( "_conditional", dict("expr", list(dict( "left", "[sometag]", "test", "!~", "right", "'^SOME_STRING'", - ))), + ))), "percentage", 80, "periodic_flush", true, - )), + )), dict('drop', dict("_conditional", dict("expr", list(dict( "left", "[someothertag]", "test", "=~", "right", "'^SOME_OTHERSTRING'", - ))))), + ))))), dict("date", dict( "match", dict( "name", "timestamp", "pattern", list("E MMM dd HH:mm:ss.SSS yyyy", "E MMM d HH:mm:ss.SSS yyyy"), - ), - )), - ), + ), + )), + ), )); diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/7.0/tests/profiles/server.pan b/ncm-metaconfig/src/main/metaconfig/logstash/7.0/tests/profiles/server.pan index 9774b3d34f..0f0553bdd0 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/7.0/tests/profiles/server.pan +++ b/ncm-metaconfig/src/main/metaconfig/logstash/7.0/tests/profiles/server.pan @@ -48,7 +48,7 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'remotegelf'", - )), + )), "plugins", list(dict("mutate", dict( "split", dict("tags", ", "), ))), @@ -60,53 +60,55 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[type]", "test", "==", "right", "'syslog'", - )), + )), "plugins", list( dict("grok", dict( "match", list(dict( "name", "message", "pattern", SYSLOG_GROK_PATTERNS, - )), + )), "patterns_dir", list("/usr/share/grok"), "add_field", dict( "received_at", "%{@timestamp}", "received_from", "%{@source_host}", - ), + ), "tag_on_failure", list('sometag'), "overwrite", list('somefield'), "target", "somespace", "timeout_scope", "event", "timeout_millis", 1000, - )), + )), dict("kv", dict( "source", "KEY_EQ_VALUEDATA", - )), + )), dict("geoip", dict( "source", "fwsrc", "fields", list("country_name", "city_name"), - )), + )), dict("date", dict( "match", dict( "name", "syslog_timestamp", "pattern", list("yyyy-MM-dd'T'HH:mm:ss.SSSSSSZZ", "yyyy-MM-dd'T'HH:mm:ssZZ"), - ), - )), + ), + )), dict("mutate", dict( "_conditional", dict('expr', list(dict( "left", "'_grokparsefailure'", "test", "not in", "right", "[tags]", - ))), + ))), "replace", list( dict( "name", "@source_host", - "pattern", "%{syslog_hostname}"), + "pattern", "%{syslog_hostname}", + ), dict( "name", "@message", - "pattern", "%{syslog_message}"), + "pattern", "%{syslog_message}", ), + ), "strip", list("@message"), - )), + )), dict("mutate", dict( "_conditional", dict('expr', list( dict( @@ -117,15 +119,15 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. dict( "join", "and", "left", "[jube_id]", - ))), + ), + )), "convert", dict( - "success", "boolean", - ) - ), - ), + "success", "boolean", + ) + )), dict("mutate", dict( "remove_field", list("syslog_hostname", "syslog_message", "syslog_timestamp"), - )), + )), dict("bytes2human", dict( "convert", dict( "volumedata", "bytes", @@ -135,26 +137,26 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "objrecovthr", "bytes", "actwrite", "bytes", "actread", "bytes", - ), - )), + ), + )), dict("mutate", dict( "_conditional", dict("expr", list(dict( "left", "[program]", "test", "==", "right", "\"jube\"", - ))), + ))), "update", dict(escape("[@metadata][target_index]"), "longterm-%{+YYYY}"), - )), - ), - ) -); + )), + ), +)); "filter/plugins" = append(dict( - "mutate", dict( - "add_field", dict( - escape("[@metadata][target_index]"), "logstash-%{+YYYY.MM.dd}" - ), - ))); + "mutate", dict( + "add_field", dict( + escape("[@metadata][target_index]"), "logstash-%{+YYYY.MM.dd}" + ), + ), +)); "filter/conditionals" = append(dict( @@ -163,13 +165,13 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "left", "[program]", "test", "==", "right", "'gpfsbeat'", - )), + )), "plugins", list( dict("mutate", dict( "update", dict(escape("[@metadata][target_index]"), "longterm-%{+YYYY}"), )), ), - )); +)); # reset the output, to remove the GELF output "output" = dict("plugins", list(dict( @@ -177,7 +179,5 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash. "hosts", list("localhost:9200"), "template_overwrite", true, "index", "%{[@metadata][target_index]}", - ), + ), ))); - - diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_1.2.pan b/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_1.2.pan index afa738a8c1..b608feab57 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_1.2.pan +++ b/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_1.2.pan @@ -37,8 +37,11 @@ type logstash_conditional = { type logstash_plugin_common = { @{using _conditional to avoid name clash with plugin option name. The conditional is only for the single plugin and has to be type 'if' (the default).} - "_conditional" ? logstash_conditional with { if (SELF['type'] != 'if') { - error('plugin _conditional has to be type if (the default)'); }; true; + "_conditional" ? logstash_conditional with { + if (SELF['type'] != 'if') { + error('plugin _conditional has to be type if (the default)'); + }; + true; } }; diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_2.0.pan b/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_2.0.pan index 459c35621b..ff8c208d7e 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_2.0.pan +++ b/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_2.0.pan @@ -37,8 +37,11 @@ type logstash_conditional = { type logstash_plugin_common = { @{using _conditional to avoid name clash with plugin option name. The conditional is only for the single plugin and has to be type 'if' (the default).} - "_conditional" ? logstash_conditional with { if (SELF['type'] != 'if') { - error('plugin _conditional has to be type if (the default)'); }; true; + "_conditional" ? logstash_conditional with { + if (SELF['type'] != 'if') { + error('plugin _conditional has to be type if (the default)'); + }; + true; } }; diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_5.0.pan b/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_5.0.pan index cbf5999da8..e8bb7f45a3 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_5.0.pan +++ b/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_5.0.pan @@ -36,8 +36,11 @@ type logstash_conditional = { type logstash_plugin_common = { @{using _conditional to avoid name clash with plugin option name. The conditional is only for the single plugin and has to be type 'if' (the default).} - "_conditional" ? logstash_conditional with { if (SELF['type'] != 'if') { - error('plugin _conditional has to be type if (the default)'); }; true; + "_conditional" ? logstash_conditional with { + if (SELF['type'] != 'if') { + error('plugin _conditional has to be type if (the default)'); + }; + true; } }; diff --git a/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_7.0.pan b/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_7.0.pan index e6fa3003bd..2a5be1a09f 100644 --- a/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_7.0.pan +++ b/ncm-metaconfig/src/main/metaconfig/logstash/pan/schema_7.0.pan @@ -36,8 +36,11 @@ type logstash_conditional = { type logstash_plugin_common = { @{using _conditional to avoid name clash with plugin option name. The conditional is only for the single plugin and has to be type 'if' (the default).} - "_conditional" ? logstash_conditional with { if (SELF['type'] != 'if') { - error('plugin _conditional has to be type if (the default)'); }; true; + "_conditional" ? logstash_conditional with { + if (SELF['type'] != 'if') { + error('plugin _conditional has to be type if (the default)'); + }; + true; } };