adopt logstash-filter-hex_to_ascii into logstash-plugins org
- Dominant language
- Java
- Stars
- 14.9k
- Forks
- 3.5k
- Avg merge
- 19h 14m
- Merged PRs (30d)
- 63
Description
The documentation for initiating a request to move a plugin to the logstash-plugin says to open an issue on this repo (https://www.elastic.co/guide/en/logstash/current/_how_to_write_a_logstash_output_plugin.html). Please let me know if this request should go elsewhere or if it needs any other information --
We would like to move a filter plugin into the logstash-plugins org. The plugin is at:
- github: https://github.com/joemiller/logstash-filter-hex_to_ascii
- rubygems: https://rubygems.org/gems/logstash-filter-hex_to_ascii
We have used the plugin for several years to assist in parsing some `auditd` logs emitted to systemd-journald. Though this plugin is usable in other situations.
basic example, convert a `0x` hex-string to text:
```
$ echo '0x6364202F6F70742F' \
| logstash \
-e 'input{stdin{}} filter{hex_to_ascii{}} output{stdout{codec => rubydebug}}'
{
"@timestamp" => 2017-08-02T20:01:52.179Z,
"message" => "cd /opt/"
}
```
Example converting a pam_tty_audit message's hex-encoded `data=` string into text:
```
$ echo ' pid=13334 uid=987 auid=4294967295 ses=4294967295 msg=cwd="/" cmd=2F62696E2F66696E64 terminal=? res=success' \
| logstash \
-e 'input{stdin{}} filter{hex_to_ascii{prefix => "cmd="}} output{stdout{codec => rubydebug}}'
{
"@timestamp" => 2017-08-02T20:14:02.267Z,
"@version" => "1",
"message" => " pid=13334 uid=987 auid=4294967295 ses=4294967295 msg=cwd=\"/\" /bin/find terminal=? res=success"
}
```
Contributor guide
Assessment
This issue has not been assessed yet.