elastic / elastic/logstash

adopt logstash-filter-hex_to_ascii into logstash-plugins org

Open
#7,883 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

The documentation for initiating a request to move a plugin to the logstash-plugin says to open an issue on this repo (https://www.elastic.co/guide/en/logstash/current/_how_to_write_a_logstash_output_plugin.html). Please let me know if this request should go elsewhere or if it needs any other information --

We would like to move a filter plugin into the logstash-plugins org. The plugin is at:
- github: https://github.com/joemiller/logstash-filter-hex_to_ascii
- rubygems: https://rubygems.org/gems/logstash-filter-hex_to_ascii

We have used the plugin for several years to assist in parsing some `auditd` logs emitted to systemd-journald. Though this plugin is usable in other situations.

basic example, convert a `0x` hex-string to text:

```
$ echo '0x6364202F6F70742F' \
| logstash \
-e 'input{stdin{}} filter{hex_to_ascii{}} output{stdout{codec => rubydebug}}'
{
"@timestamp" => 2017-08-02T20:01:52.179Z,
"message" => "cd /opt/"
}
```

Example converting a pam_tty_audit message's hex-encoded `data=` string into text:
```
$ echo ' pid=13334 uid=987 auid=4294967295 ses=4294967295 msg=cwd="/" cmd=2F62696E2F66696E64 terminal=? res=success' \
| logstash \
-e 'input{stdin{}} filter{hex_to_ascii{prefix => "cmd="}} output{stdout{codec => rubydebug}}'
{
"@timestamp" => 2017-08-02T20:14:02.267Z,
"@version" => "1",
"message" => " pid=13334 uid=987 auid=4294967295 ses=4294967295 msg=cwd=\"/\" /bin/find terminal=? res=success"
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.