Examples with Version org.graylog2.plugin.Version used on opensource projects

Example 11 with Version

use of org.graylog2.plugin.Version in project graylog2-server by Graylog2.

the class GelfCodecTest method decodeLargeCompressedMessageFails.

@Test
public void decodeLargeCompressedMessageFails() throws Exception {
    expectedException.expect(IllegalStateException.class);
    expectedException.expectMessage("JSON is null/could not be parsed (invalid JSON)");
    expectedException.expectCause(isA(JsonParseException.class));
    final Configuration configuration = new Configuration(Collections.singletonMap("decompress_size_limit", 100));
    final GelfCodec codec = new GelfCodec(configuration, aggregator);
    final String json = "{" + "\"version\": \"1.1\"," + "\"host\": \"example.org\"," + "\"short_message\": \"A short message that helps you identify what is going on\"," + "\"full_message\": \"Backtrace here\\n\\nMore stuff\"," + "\"timestamp\": 1385053862.3072," + "\"level\": 1," + "\"_some_bytes1\": \"Lorem ipsum dolor sit amet, consetetur sadipscing elitr, \"," + "\"_some_bytes2\": \"sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, \"," + "\"_some_bytes2\": \"sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum.\"" + "}";
    final byte[] payload = TestHelper.zlibCompress(json);
    assumeTrue(payload.length > 100);
    final RawMessage rawMessage = new RawMessage(payload);
    codec.decode(rawMessage);
}

Example 12 with Version

use of org.graylog2.plugin.Version in project graylog2-server by Graylog2.

the class SyslogCodecTest method testDecodeStructuredIssue845.

@Test
public void testDecodeStructuredIssue845() throws Exception {
    final Message message = codec.decode(buildRawMessage(STRUCTURED_ISSUE_845));
    assertNotNull(message);
    assertEquals(message.getMessage(), "User page 13 requested");
    assertEquals(((DateTime) message.getField("timestamp")).withZone(DateTimeZone.UTC), new DateTime("2015-01-06T20:56:33.287Z", DateTimeZone.UTC));
    assertEquals(message.getField("source"), "app-1");
    assertEquals(message.getField("level"), 6);
    assertEquals(message.getField("facility"), "local7");
    assertEquals(message.getField("ip"), "::ffff:132.123.15.30");
    assertEquals(message.getField("logger"), "{c.corp.Handler}");
    assertEquals(message.getField("session"), "4ot7");
    assertEquals(message.getField("user"), "user@example.com");
    assertEquals(message.getField("user-agent"), "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/7.1.2 Safari/537.85.11");
    assertEquals(message.getField("application_name"), "app");
}

Example 13 with Version

use of org.graylog2.plugin.Version in project graylog2-server by Graylog2.

the class SyslogCodecTest method testDecodeStructuredIssue845WithExpandStructuredData.

@Test
public void testDecodeStructuredIssue845WithExpandStructuredData() throws Exception {
    when(configuration.getBoolean(SyslogCodec.CK_EXPAND_STRUCTURED_DATA)).thenReturn(true);
    final SyslogCodec codec = new SyslogCodec(configuration, metricRegistry);
    final Message message = codec.decode(buildRawMessage(STRUCTURED_ISSUE_845));
    assertNotNull(message);
    assertEquals(message.getMessage(), "User page 13 requested");
    assertEquals(((DateTime) message.getField("timestamp")).withZone(DateTimeZone.UTC), new DateTime("2015-01-06T20:56:33.287Z", DateTimeZone.UTC));
    assertEquals(message.getField("source"), "app-1");
    assertEquals(message.getField("level"), 6);
    assertEquals(message.getField("facility"), "local7");
    assertEquals(message.getField("mdc@18060_ip"), "::ffff:132.123.15.30");
    assertEquals(message.getField("mdc@18060_logger"), "{c.corp.Handler}");
    assertEquals(message.getField("mdc@18060_session"), "4ot7");
    assertEquals(message.getField("mdc@18060_user"), "user@example.com");
    assertEquals(message.getField("mdc@18060_user-agent"), "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/7.1.2 Safari/537.85.11");
    assertEquals(message.getField("application_name"), "app");
}

Example 14 with Version

use of org.graylog2.plugin.Version in project graylog2-server by Graylog2.

the class GelfCodec method decode.

@Nullable
@Override
public Message decode(@Nonnull final RawMessage rawMessage) {
    final GELFMessage gelfMessage = new GELFMessage(rawMessage.getPayload(), rawMessage.getRemoteAddress());
    final String json = gelfMessage.getJSON(decompressSizeLimit);
    final JsonNode node;
    try {
        node = objectMapper.readTree(json);
    } catch (final Exception e) {
        log.error("Could not parse JSON, first 400 characters: " + StringUtils.abbreviate(json, 403), e);
        throw new IllegalStateException("JSON is null/could not be parsed (invalid JSON)", e);
    }
    // Timestamp.
    final double messageTimestamp = doubleValue(node, "timestamp");
    final DateTime timestamp;
    if (messageTimestamp <= 0) {
        timestamp = rawMessage.getTimestamp();
    } else {
        // we treat this as a unix timestamp
        timestamp = Tools.dateTimeFromDouble(messageTimestamp);
    }
    final Message message = new Message(stringValue(node, "short_message"), stringValue(node, "host"), timestamp);
    message.addField("full_message", stringValue(node, "full_message"));
    final String file = stringValue(node, "file");
    if (file != null && !file.isEmpty()) {
        message.addField("file", file);
    }
    final long line = longValue(node, "line");
    if (line > -1) {
        message.addField("line", line);
    }
    // Level is set by server if not specified by client.
    final int level = intValue(node, "level");
    if (level > -1) {
        message.addField("level", level);
    }
    // Facility is set by server if not specified by client.
    final String facility = stringValue(node, "facility");
    if (facility != null && !facility.isEmpty()) {
        message.addField("facility", facility);
    }
    // Add additional data if there is some.
    final Iterator<Map.Entry<String, JsonNode>> fields = node.fields();
    while (fields.hasNext()) {
        final Map.Entry<String, JsonNode> entry = fields.next();
        String key = entry.getKey();
        // Do not index useless GELF "version" field.
        if ("version".equals(key)) {
            continue;
        }
        // Don't include GELF syntax underscore in message field key.
        if (key.startsWith("_") && key.length() > 1) {
            key = key.substring(1);
        }
        // We already set short_message and host as message and source. Do not add as fields again.
        if ("short_message".equals(key) || "host".equals(key)) {
            continue;
        }
        // Skip standard or already set fields.
        if (message.getField(key) != null || Message.RESERVED_FIELDS.contains(key) && !Message.RESERVED_SETTABLE_FIELDS.contains(key)) {
            continue;
        }
        // Convert JSON containers to Strings, and pick a suitable number representation.
        final JsonNode value = entry.getValue();
        final Object fieldValue;
        if (value.isContainerNode()) {
            fieldValue = value.toString();
        } else if (value.isFloatingPointNumber()) {
            fieldValue = value.asDouble();
        } else if (value.isIntegralNumber()) {
            fieldValue = value.asLong();
        } else if (value.isNull()) {
            log.debug("Field [{}] is NULL. Skipping.", key);
            continue;
        } else if (value.isTextual()) {
            fieldValue = value.asText();
        } else {
            log.debug("Field [{}] has unknown value type. Skipping.", key);
            continue;
        }
        message.addField(key, fieldValue);
    }
    return message;
}

Example 15 with Version

use of org.graylog2.plugin.Version in project graylog2-server by Graylog2.

the class SyslogCodec method parse.

private Message parse(String msg, InetAddress remoteAddress, DateTime receivedTimestamp) {
    /*
         * ZOMG funny 80s neckbeard protocols. We are now deciding if to parse
         * structured (RFC5424) or unstructured (classic BSD, RFC3164) syslog
         * by checking if there is a VERSION after the PRI. Sorry.
         *
         *                            ._.                                  _
         *    R-O-F-L-R-O-F-L-R-O-F-L-IOI-R-O-F-L-R-O-F-L-R-O-F-L         / l
         *                ___________/LOL\____                           /: ]
         *            .__/°         °\___/°   \                         / ::\
         *           /^^ \            °  °     \_______.__________.____/: OO:\
         *      .__./     j      ________             _________________ ::OO::|
         *    ./ ^^ j____/°     [\______/]      .____/                 \__:__/
         *  ._|____/°    °       <{(OMG{<       /                         ::
         * /  °    °              (OMFG{       /
         * |°  loooooooooooooooooooooooooooooooool
         *         °L|                   L|
         *          ()                   ()
         *
         *
         *  http://open.spotify.com/track/2ZtQKBB8wDTtPPqDZhy7xZ
         *
         */
    final SyslogServerEventIF e;
    if (STRUCTURED_SYSLOG_PATTERN.matcher(msg).matches()) {
        e = new StructuredSyslogServerEvent(msg, remoteAddress);
    } else {
        e = new SyslogServerEvent(msg, remoteAddress);
    }
    // If the message is a structured one, we do not want the message ID and the structured data in the
    // message string. See: https://github.com/Graylog2/graylog2-server/issues/845#issuecomment-69499719
    final String syslogMessage;
    if (e instanceof StructuredSyslogServerEvent) {
        final String structMessage = ((StructuredSyslogServerEvent) e).getStructuredMessage().getMessage();
        syslogMessage = isNullOrEmpty(structMessage) ? e.getMessage() : structMessage;
    } else {
        syslogMessage = e.getMessage();
    }
    final Message m = new Message(syslogMessage, parseHost(e, remoteAddress), parseDate(e, receivedTimestamp));
    m.addField("facility", Tools.syslogFacilityToReadable(e.getFacility()));
    m.addField("level", e.getLevel());
    // Store full message if configured.
    if (configuration.getBoolean(CK_STORE_FULL_MESSAGE)) {
        m.addField("full_message", new String(e.getRaw(), StandardCharsets.UTF_8));
    }
    final boolean expandStructuredData = configuration.getBoolean(CK_EXPAND_STRUCTURED_DATA);
    m.addFields(parseAdditionalData(e, expandStructuredData));
    return m;
}