Skip to content

Instantly share code, notes, and snippets.

View yaauie's full-sized avatar

Ry Biesemeyer yaauie

View GitHub Profile
@yaauie
yaauie / listup
Last active October 6, 2022 22:36
#!/bin/sh
#
# Utility for determining why we cannot list the
# contents of a deeply-nested directory.
#
# Usage:
# listup.sh /deeply/nested/path
#
##############################################################################
# Copyright 2022 Ry Biesemeyer
@yaauie
yaauie / flatten-structure.logstash-filter-ruby.rb
Created September 13, 2022 01:31
Flatten all or part of a Logstash event, in-place or targeted, optionally destructively
###############################################################################
# flatten-structure.logstash-filter-ruby.rb
# ---------------------------------
# A script for a Logstash Ruby Filter to flatten a nested structure to produce
# flat structure whose keys are the paths of the previous structure
###############################################################################
#
# Copyright 2022 Ry Biesemeyer
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
@yaauie
yaauie / org.logstash.instrument.metrics.timer.ExecutionTimer.java
Created August 30, 2022 20:41
ExecutionTimer for getting the cumulative execution time including in-progress execution.
package org.logstash.instrument.metrics.timer;
import org.logstash.instrument.metrics.AbstractMetric;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.atomic.AtomicReference;
import java.util.function.LongSupplier;
import java.util.function.Supplier;
/**
@yaauie
yaauie / replace-with-serialzied.logstash-filter-ruby.rb
Last active April 26, 2022 06:56
Logstash Ruby Filter script to replace a structured event's data with a single field containing a JSON-serialized string representing the same data.
###############################################################################
# replace-with-serialzied.logstash-filter-ruby.rb
# ---------------------------------
# A script for a Logstash Ruby Filter to replace the event's contents with a
# single field containing a string JSON-encoded representation of the event.
#
# This filter _MUTATES_ the event, removing all DATA-keys while leaving METADATA
# in-tact.
#
###############################################################################

The included apply-template.rb provides a way generate Logstash config fragments from a shared template.

This can be useful for shared verbose configuration that is shared across multiple pipelines.

For example, if we are using multiple pipelines with pipelines.yml

 - pipeline.id: one
   path.config: "${LOGSTASH_HOME}/pipelines/one/*.conf"
 - pipeline.id: two
@yaauie
yaauie / JRUBY.out
Created February 16, 2022 18:23
Reproduction demonstrating a difference in behaviour between MRI and JRuby for keyword arg splats of aliased methods, as discovered in Sinatra 2.2.0
╭─{ yaauie@limbo:~/src/elastic/ls (✔ 8.0) }
╰─● (rbenv shell jruby-9.2.19.0; ruby kwargs-splat.rb)
ArgumentError: wrong number of arguments calling `initialize` (given 1, expected 0)
new at kwargs-splat.rb:7
<main> at kwargs-splat.rb:17
( rbenv shell jruby-9.2.19.0; ruby kwargs-splat.rb; ) 9.23s user 0.53s system 405% cpu 2.412 total
[error: 1]
###############################################################################
# json-sanitize-field-names.logstash-filter-ruby.rb
# ---------------------------------
# A script for a Logstash Ruby Filter to transform a JSON string so that the
# resulting JSON string's decoded representation does not contain square
# brackets in keys.
#
# This filter does NOT parse the JSON string into an Object, and has undefined
# behaviour when the string is not valid JSON.
#
@yaauie
yaauie / USAGE.md
Last active October 28, 2021 22:51
Proof-of-concept high-precision timestamp parser for Logstash, using the Logstash Ruby Filter and Ruby's Time object.
filter {
  ruby {
    path => "${PWD}/precision-timestamp-parse.logstash-filter-ruby.rb"
    script_params => {
      source => "precise-timestamp-field"
      format => "ISO8601"
    }
  }
}
@yaauie
yaauie / pin-racc-pending-release-of-1.6-artifact-for-java.patch
Created October 19, 2021 14:35
RACC 1.6 was released without an accompanying java artifact for jruby. This patch pins racc in logstash-core.
diff --git a/logstash-core/logstash-core.gemspec b/logstash-core/logstash-core.gemspec
index e22a9f289..a4563498a 100644
--- a/logstash-core/logstash-core.gemspec
+++ b/logstash-core/logstash-core.gemspec
@@ -78,4 +78,8 @@ Gem::Specification.new do |gem|
gem.add_dependency 'down', '~> 5.2.0' #(MIT license)
gem.add_dependency 'tzinfo-data' #(MIT license)
gem.add_dependency 'rufus-scheduler' #(MIT license)
+
+ # TEMPORARY: racc-1.6.0 doesn't have JAVA counterpart (yet)
@yaauie
yaauie / logstash-codec-csv.auto-flush-on-evict.patch
Last active September 28, 2021 20:24
Patch Logstash CSV Codec 1.0.0 to ensure the Logstash File Input re-detects column names per file (NOT NECESSARY with logstash-codec-multiline >= 3.1.1)
diff --git a/lib/logstash/codecs/csv.rb b/lib/logstash/codecs/csv.rb
index 07d6416..66cd6ed 100644
--- a/lib/logstash/codecs/csv.rb
+++ b/lib/logstash/codecs/csv.rb
@@ -133,12 +133,19 @@ class LogStash::Codecs::CSV < LogStash::Codecs::Base
rescue CSV::MalformedCSVError => e
@logger.error("CSV parse failure. Falling back to plain-text", :error => e, :data => data)
yield LogStash::Event.new("message" => data, "tags" => ["_csvparsefailure"])
end
end