Skip to content

Instantly share code, notes, and snippets.

Avatar

Ry Biesemeyer yaauie

View GitHub Profile
@yaauie
yaauie / downcase-field-names.logstash-filter-ruby.rb
Created Oct 14, 2020
A script for a Logstash Ruby Filter to transform field names to all lowercase
View downcase-field-names.logstash-filter-ruby.rb
###############################################################################
# downcase-field-names.logstash-filter-ruby.rb
# ---------------------------------
# A script for a Logstash Ruby Filter to transform field names to all lowercase
###############################################################################
#
# Copyright 2020 Ry Biesemeyer
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
View stringify-timestamp.logstash-filter-ruby.rb
###############################################################################
# stringify-timestamp.logstash-filter-ruby.rb
# ---------------------------------
# A script for a Logstash Ruby Filter to stringify logstash timestamps using
# ISO-8601.
###############################################################################
#
# Copyright 2020 Ry Biesemeyer
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
@yaauie
yaauie / ecs-complaint-host-geoip.conf
Created Jul 22, 2020
Example remapping the fields output by GeoIP filter for a host ip to ECS's host geo fields, as identified in the ECS compatibility mode issue https://github.com/logstash-plugins/logstash-filter-geoip/issues/163#issuecomment-592177677
View ecs-complaint-host-geoip.conf
filter {
geoip {
source => "[host][ip]"
target => "[@metadata][host_geoip]"
}
if [@metadata][host_geoip] {
mutate {
copy => {
"[@metadata][host_geoip][city_name]" => "[host][geo][city_name]"
"[@metadata][host_geoip][country_name]" => "[host][geo][country_name]"
@yaauie
yaauie / delete-emtpy-nodes.logstash-filter-ruby.rb
Last active Jul 28, 2020
A script for a Logstash Ruby Filter to delete empty nodes from an event; by default, crawls the entire event recursively, but it can be configured to limit the scope.
View delete-emtpy-nodes.logstash-filter-ruby.rb
###############################################################################
# delete-emtpy-nodes.logstash-filter-ruby.rb
# ---------------------------------
# A script for a Logstash Ruby Filter to delete empty nodes from an event; by
# default, crawls the entire event recursively, but it can be configured to
# limit the scope.
###############################################################################
#
# Copyright 2018 Ry Biesemeyer
#
@yaauie
yaauie / tag-when-fields-over-threshold.logstash-filter-ruby.rb
Last active Jun 1, 2020
Logstash: tag when field count over threshold
View tag-when-fields-over-threshold.logstash-filter-ruby.rb
###############################################################################
# tag-when-fields-over-threshold.logstash-filter-ruby.rb
# ---------------------------------
# A script for a Logstash Ruby Filter to tag an event when it has "too many"
# fields, with a configurable threshold.
###############################################################################
#
# Copyright 2020 Ry Biesemeyer
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
View replace-subset.logstash-filter-ruby.rb
###############################################################################
# replace-subset.logstash-filter-ruby.rb
# ---------------------------------
# A script for a Logstash Ruby Filter to replace an event's contents with a
# subset that exists as an object in a field.
###############################################################################
#
# Copyright 2020 Ry Biesemeyer
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
@yaauie
yaauie / hello.jscript.bat
Created May 6, 2011
A Polyglot for jscript in batch
View hello.jscript.bat
0</* :hello
@ECHO Hello, batch!
@cscript /nologo /E:jscript %~f0 %*
@goto :EOF
*/0;
WScript.Echo('Hello, jscript!');
View processor-hostname.logstash-filter-ruby.rb
filter {
ruby {
path => "${PWD}/processor-hostname.logstash-filter-ruby.rb"
script_params => {
"target" => "@processed-by"
}
}
}
@yaauie
yaauie / pipeline.conf
Last active May 6, 2019
A script for a Logstash Ruby Filter to transpose an array of two-element objects representing key/value tuples into a single hash/map
View pipeline.conf
filter {
# to convert an array of key/value objects into a single unordered
# key/value map, use the included `transpose` script:
ruby {
path => "${PWD}/transpose.logstash-filter-ruby.rb"
script_params => {
source => "[proplist]"
}
}
@yaauie
yaauie / back_pressure_provider.rb
Created Apr 29, 2019
proof-of-concept generic back-pressure provider, enables blocking back-pressure to be controlled outside the code that is performing the actions.
View back_pressure_provider.rb
# The BackPressureProvider allows back-pressure to be applied to non-blocking APIs when those APIs also
# provide hooks for identifying when they _should_ block.
class BackPressureProvider
def initialize(desc, logger)
@desc = desc
@logger = logger
@mutex = Mutex.new
@cond = ConditionVariable.new
@back_pressure_engaged = false
You can’t perform that action at this time.