class Fluent::PcapngInput
Constants
- DOUBLE
- LONG
- STRING
- TIME
Public Class Methods
new()
click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_pcapng.rb, line 33 def initialize super end
Public Instance Methods
build_extra_flags(extra_flags)
click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 104 def build_extra_flags(extra_flags) options = "" valid_flag_re = /(?:-[a-zA-Z]|--[a-z\-]+)/ extra_flags.each do |i| if !i.match(/^#{valid_flag_re}/) raise ArgumentError, format("Invalid flags in extra_flags %s", i) end # escape given flags here because it is easier to understand, or write, # extra_flags in fluentd config. (k, v) = i.split(/\s+/, 2) options += "#{Shellwords.escape(k)} " options += "#{Shellwords.escape(v)} " if v end return options end
build_options(fields)
click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 96 def build_options(fields) options = "" fields.each do |field| options += "-e #{Shellwords.escape(field)} " end return options end
collect_tshark_output(stdout)
click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 121 def collect_tshark_output(stdout) collected = [] begin readlines_nonblock(stdout).each do |line| array = CSV.parse(line).flatten collected << array end rescue => e log.error "pcapng failed to read or parse line", :error => e.to_s, :error_class => e.class.to_s end collected.each do |ary| router.emit(@tag, Engine.now, generate_record(ary)) end rescue => e log.error "pcapng failed to collect output from tshark", :error => e.to_s, :error_class => e.class.to_s end
configure(conf)
click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_pcapng.rb, line 48 def configure(conf) super if @fields != nil and @fields == [] raise ConfigError, "'fields' option is required on pcapng input" end if @types and @types.length != @fields.length raise ConfigError, "'types' length must be equal to 'fields' length" end end
convert_type(val, type)
click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 173 def convert_type val, type v = val.to_s.gsub("\"", "") v = "" if val == nil case type when LONG if v.is_a?(String) and v.match(/^0x[0-9a-fA-F]+$/) v = v.hex else v = v.to_i end when DOUBLE v = v.to_f when TIME v = Time.parse(v) end return v end
convert_types(array)
click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 167 def convert_types(array) return [array, @types].transpose.map{|val, type| convert_type(val, type) } end
generate_record(array)
click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 155 def generate_record(array) fields = @fields if fields.length != array.length return {} end carray = convert_types(array) if @convertdot fields = fields.map{|field| field.gsub(".", @convertdot)} end return Hash[[fields, carray].transpose] end
readlines_nonblock(io)
click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 142 def readlines_nonblock(io) @nbbuffer = "" if @nbbuffer == nil @nbbuffer += io.read_nonblock(65535) lines = [] while idx = @nbbuffer.index("\n") lines << @nbbuffer[0..idx-1] @nbbuffer = @nbbuffer[idx+1..-1] end return lines rescue return [] end
run()
click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 77 def run options = build_options(@fields) options += build_extra_flags(@extra_flags) cmdline = "tshark -i #{Shellwords.escape(@interface)} -T fields -E separator=\",\" -E quote=d #{options}" log.debug format("pcapng: %s", cmdline) _stdin, stdout, stderr, @th_tshark = *Open3.popen3(cmdline) while @th_tshark.alive? collect_tshark_output(stdout) end stderr.each do |l| log.error(l.chomp) end raise RuntimeError, "tshark is not running" rescue => e log.error "unexpected error", :error => e.to_s log.error_backtrace e.backtrace end
shutdown()
click to toggle source
# File lib/fluent/plugin/in_pcapng.rb, line 66 def shutdown if @th_tshark and @th_tshark.alive? Process.kill("INT", @th_tshark.pid) end @thread.join rescue => e log.error "pcapng failed to shutdown", :error => e.to_s, :error_class => e.class.to_s log.error_backtrace e.backtrace end
start()
click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_pcapng.rb, line 60 def start super @thread = Thread.new(&method(:run)) end