Merge pull request #38 from gabelilly/logstash-5.4

Update filters to conform to Logstash 5.4

Author: bitsofinfo

2000_filter_sections_split.conf

@@ -26,8 +26,8 @@ filter {
 
     ruby {
       code => "
-          if !event['message'].nil?
-              modSecSectionData = event['message'].split(/(?:--[a-fA-F0-9]{8}-([A-Z])--)/)
+          if !event.get('message').nil?
+              modSecSectionData = event.get('message').split(/(?:--[a-fA-F0-9]{8}-([A-Z])--)/)
               modSecSectionData.shift
               for i in 0..((modSecSectionData.length-1)/2)
                   sectionName = 'rawSection'.concat(modSecSectionData.shift)
@@ -36,7 +36,7 @@ filter {
                   if !sectionData.nil?
                       sectionData = sectionData.strip
                   end
-                  event.to_hash.merge!(sectionName => sectionData)
+                  event.set(sectionName, sectionData)
               end
           end
         "

2021_filter_section_b_headers_key-value.conf

@@ -1,5 +1,6 @@
 filter {
   if [type] == "mod_security" {
+
     #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     # Convert raw request headers into a key/value
     # pair map
@@ -17,7 +18,7 @@ filter {
       # trim leading/trailing hack  @see https://logstash.jira.com/browse/LOGSTASH-1369
       ruby {
         code => "
-            requestHeaders = event.to_hash['requestHeaders']
+            requestHeaders = event.get('requestHeaders').to_hash
             requestHeaders.each { |k, v|
               if !v.nil? and v.is_a? String
                 requestHeaders[k] = v.strip

2062_filter_section_f_headers_key-value.conf

@@ -17,7 +17,7 @@ filter {
       # trim leading/trailing hack  @see https://logstash.jira.com/browse/LOGSTASH-1369
       ruby {
         code => "
-            responseHeaders = event.to_hash['responseHeaders']
+            responseHeaders = event.get('responseHeaders').to_hash
             responseHeaders.each { |k, v|
               if !v.nil? and v.is_a? String
                 responseHeaders[k] = v.strip

2080_filter_section_h_parse_messages_to_auditLogTrailerMessages.conf

@@ -27,7 +27,7 @@ filter {
             end
 
             auditLogTrailerMessages = Array.new()
-            trailer_array = event.to_hash['rawSectionH'].split(/\n/)
+            trailer_array = event.get('rawSectionH').split(/\n/)
             trailer_array.each do |entry|
               if entry.match(/^Message: /)
                 msg = Hash.new()
@@ -43,7 +43,7 @@ filter {
               end
             end
 
-            event.to_hash.merge!('auditLogTrailerMessages' => auditLogTrailerMessages)
+            event.set('auditLogTrailerMessages', auditLogTrailerMessages)
           "
       }
     }

2081_filter_section_h_convert_to_key-value.conf

@@ -20,18 +20,21 @@ filter {
       # trim leading/trailing hack  @see https://logstash.jira.com/browse/LOGSTASH-1369
       ruby {
         code => "
-            auditLogTrailer = event.to_hash['auditLogTrailer']
-            auditLogTrailerMessages = event.to_hash['auditLogTrailerMessages']
+            auditLogTrailer = event.get('auditLogTrailer').to_hash
+            auditLogTrailerMessages = event.get('auditLogTrailerMessages').to_hash
             auditLogTrailer.each { |k, v|
               if !v.nil? and v.is_a? String
                 auditLogTrailer[k] = v.strip
               end
             }
             auditLogTrailer.delete('Message')
             auditLogTrailer['messages'] = auditLogTrailerMessages
-            event.to_hash.delete('auditLogTrailerMessages')
           "
       }
+
+      drop {
+        remove_field => ['auditLogTrailerMessages']
+      }
     }
   }
 }

2082_filter_section_h_extract_stopwatch.conf

@@ -24,16 +24,16 @@ filter {
     # micro -> milli
     ruby {
       code => "
-          event_date_milliseconds = (event.to_hash['event_date_microseconds'] / 1000.0)
-          event.to_hash.merge!('event_date_milliseconds' => event_date_milliseconds)
+          event_date_milliseconds = (event.get('event_date_microseconds') / 1000.0)
+          event.set('event_date_milliseconds', event_date_milliseconds)
         "
     }
 
     # milli -> seconds
     ruby {
       code => "
-          event_date_seconds = (event.to_hash['event_date_milliseconds'] / 1000.0)
-          event.to_hash.merge!('event_date_seconds' => event_date_seconds)
+          event_date_seconds = (event.get('event_date_milliseconds') / 1000.0)
+          event.set('event_date_seconds', event_date_seconds)
         "
     }
 
@@ -46,7 +46,7 @@ filter {
     # a second copy of a iso8601 date
     ruby {
       code => "
-          event.to_hash.merge!('event_timestamp' => (Time.at(event.to_hash['event_date_seconds']).gmtime).iso8601(3))
+          event.set('event_timestamp', (Time.at(event.get('event_date_seconds')).gmtime).iso8601(3))
         "
     }
   }

2089_filter_section_h_example_geoip.conf

@@ -20,7 +20,7 @@ filter {
     # convert Strings to UTF-8, leave as-is otherwise
     #ruby {
     #  code => "
-    #      geoip = event.to_hash['XForwardedFor-GEOIP']
+    #      geoip = event.get('XForwardedFor-GEOIP').to_hash
     #      if !geoip.nil?
     #        newgeoip = Hash.new()
     #        geoip.each do |key,value|
@@ -30,7 +30,7 @@ filter {
     #            newgeoip[key] = value
     #          end
     #        end
-    #        event.to_hash.merge!('XForwardedFor-GEOIP' => newgeoip)
+    #        event.set('XForwardedFor-GEOIP', newgeoip)
     #      end
     #    "
     #}

2089_filter_section_h_example_severities.conf

@@ -11,13 +11,13 @@ filter {
     ruby {
       code => "
           modsecSeverities = Set.new
-          trailerMsgs = event.to_hash['auditLogTrailerMessages']
+          trailerMsgs = event.get('auditLogTrailerMessages').to_hash
           trailerMsgs.each {|m|
             if m.key?('severity')
               modsecSeverities.add(m['severity'])
             end
           }
-          event.to_hash.merge!('modsecSeverities' => modsecSeverities.to_a)
+          event.set('modsecSeverities', modsecSeverities.to_a)
         "
     }
   }

2110_filter_section_k_parse_matchedRules.conf

@@ -24,13 +24,13 @@ filter {
       ruby {
         code => "
             secRuleIds = Array.new()
-            matchedRules_array = event.to_hash['matchedRules']
+            matchedRules_array = event.get('matchedRules').to_hash
             matchedRules_array.each do |entry|
               if entry.match(/^SecRule /) and entry.match(/,id:/)
                 secRuleIds.push(/,id:(?<ruleId>\d+)/.match(entry)[:ruleId])
               end
             end
-            event.to_hash.merge!('secRuleIds' => secRuleIds)
+            event.set('secRuleIds', secRuleIds)
           "
       }
     }