Skip to content

Instantly share code, notes, and snippets.

❯ cat with_copy/Dockerfile
FROM centos:7
COPY logstash-8.13.2-linux-aarch64.tar.gz /tmp/logstash.tar.gz
RUN tar -zxf /tmp/logstash.tar.gz && rm /tmp/logstash.tar.gz
❯ docker build -q with_copy
sha256:fce85351f818038d93afbd4005ff4fe10a2d7771ce1e603a54f91300e4032d1e
❯ docker run -it fce85351f818038d93afbd4005ff4fe10a2d7771ce1e603a54f91300e4032d1e /logstash-8.13.2/bin/logstash -V
❯ for type in inputs filters codecs outputs; do echo "List of $type"; cat ./logstash_node_stats.json | jq -r ".pipelines | map(.plugins.$type)[] | map(.name)[]" | sort | uniq -c | sort -k2; done
List of inputs
1 beats
2 jdbc
1 syslog
1 tcp
List of filters
1 clone
4 date
1 dissect
@jsvd
jsvd / gist:25a83d57eb062a66f970da3fd8a87c42
Created March 12, 2024 11:32
Logstash with verbose:class
This file has been truncated, but you can view the full file.
/tmp/logstash-8.12.2
❯ LS_JAVA_OPTS="-verbose:class" bin/logstash -e "input { generator { count => 1 } } output { stdout {} }"
Using bundled JDK: /tmp/logstash-8.12.2/jdk.app/Contents/Home
exec "/tmp/logstash-8.12.2/jdk.app/Contents/Home/bin/java" -cp "/tmp/logstash-8.12.2/vendor/jruby/lib/jruby.jar:/tmp/logstash-8.12.2/logstash-core/lib/jars/checker-qual-3.33.0.jar:/tmp/logstash-8.12.2/logstash-core/lib/jars/commons-codec-1.15.jar:/tmp/logstash-8.12.2/logstash-core/lib/jars/commons-compiler-3.1.0.jar:/tmp/logstash-8.12.2/logstash-core/lib/jars/commons-logging-1.2.jar:/tmp/logstash-8.12.2/logstash-core/lib/jars/error_prone_annotations-2.18.0.jar:/tmp/logstash-8.12.2/logstash-core/lib/jars/failureaccess-1.0.1.jar:/tmp/logstash-8.12.2/logstash-core/lib/jars/google-java-format-1.15.0.jar:/tmp/logstash-8.12.2/logstash-core/lib/jars/guava-32.1.2-jre.jar:/tmp/logstash-8.12.2/logstash-core/lib/jars/httpclient-4.5.13.jar:/tmp/logstash-8.12.2/logstash-core/lib/jars/httpcore-4.4.14.jar:/tmp/logstash-8.12.2/logstash
require 'socket'
HOST = 'localhost'
PORT = 5555
def connect_and_close
socket = TCPSocket.new(HOST, PORT)
linger = [1,0].pack('ii')
socket.setsockopt(Socket::SOL_SOCKET, Socket::SO_LINGER, linger)
socket.close
# encoding: utf-8
# JRUBY_OPTS="-J-Xmx4g -J-Xms4g" ruby beats_writer_ssl.rb
require "socket"
require "thread"
require "zlib"
require "json"
require "openssl"
Thread.abort_on_exception = true
HOST="127.0.0.1"
# written for python 2.7
#
# CAKe : CEF Army Knife experiment
# A versatile CEF manipulation and generation tool
#
# Author : Gaetan Cardinal
# cardinal_gaetan |at| yahoo.fr
#
# Version: 0.2
# Updated: Jan 2014
@jsvd
jsvd / script.rb
Last active December 13, 2021 12:16
# encoding: utf-8
# Script to test local Logstash instance for JNDI lookups (Log4j vulnerability)
#
# To run, copy script to Logstash folder and run:
#
# bin/ruby script.rb
#
# Script's steps:
# Step 1: setup environment
require 'openssl'
require 'net/http'
def cert_from_url(url)
txt = Net::HTTP.get(URI(url))
OpenSSL::X509::Certificate.new(txt)
end
LEAF_CERTIFICATE = OpenSSL::X509::Certificate.new %q[
-----BEGIN CERTIFICATE-----
# reproducer for https://github.com/jruby/jruby-openssl/issues/236
# If a certificate has two trust paths, jruby doesn't prioritize using non expired certificates, while CRuby (openssl 1.1.1+) does
# In this reproducer we have a leaf certificate with two possible chains:
# a) leaf -> intermediate cert A -> ISRG Root X1 cross-signed by (expired) DST ROOT CA X3 -> (expired) DST ROOT CA X3
# b) leaf -> intermediate cert B -> ISRG Root X1
# JRuby will produce chain a) causing an error, while CRuby produces a valid chain b)
require 'openssl'
require 'net/http'
def cert_from_url(url)
Repos related to CI
- [ ] [logstash-devutils](https://github.com/elastic/logstash-devutils)
- [ ] [docs-tools](https://github.com/elastic/docs-tools)
- [ ] [.ci](https://github.com/logstash-plugins/.ci)
- [ ] [infra](https://github.com/elastic/infra/tree/master/ci/jjb/logstash-ci) (NOTE: no branch changes needed here, only adapting CI jobs)
Repos associated with Docs
- [ ] [logstash-docs](https://github.com/elastic/logstash-docs)