honeymoose/OpenSearch
1
0
Fork 0
mirror of https://github.com/honeymoose/OpenSearch.git synced 2025-03-24 17:09:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Extend allowed characters for grok field names (#21745) (#31653)

Browse Source
This commit is contained in:
Armin Braun 2018-06-29 09:12:47 +02:00 committed by GitHub
parent 5925611e9e
commit b7b413e55e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 51 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libs/grok/src/main/java/org/elasticsearch/grok/Grok.java
View File

@ -52,7 +52,7 @@ public final class Grok {
"%\\{" +
"(?<name>" +
"(?<pattern>[A-z0-9]+)" +
"(?::(?<subname>[A-z0-9_:.-]+))?" +
"(?::(?<subname>[[:alnum:]@\\[\\]_:.-]+))?" +
")" +
"(?:=(?<definition>" +
"(?:" +
@ -81,11 +81,11 @@ public final class Grok {
public Grok(Map<String, String> patternBank, String grokPattern) {
this(patternBank, grokPattern, true, ThreadWatchdog.noop());
}
public Grok(Map<String, String> patternBank, String grokPattern, ThreadWatchdog threadWatchdog) {
this(patternBank, grokPattern, true, threadWatchdog);
}
Grok(Map<String, String> patternBank, String grokPattern, boolean namedCaptures) {
this(patternBank, grokPattern, namedCaptures, ThreadWatchdog.noop());
}

50
libs/grok/src/test/java/org/elasticsearch/grok/GrokTests.java
View File

@ -412,10 +412,10 @@ public class GrokTests extends ESTestCase {
expected.put("num", "1");
assertThat(grok.captures("12"), equalTo(expected));
}
public void testExponentialExpressions() {
AtomicBoolean run = new AtomicBoolean(true); // to avoid a lingering thread when test has completed
String grokPattern = "Bonsuche mit folgender Anfrage: Belegart->\\[%{WORD:param2},(?<param5>(\\s*%{NOTSPACE})*)\\] " +
"Zustand->ABGESCHLOSSEN Kassennummer->%{WORD:param9} Bonnummer->%{WORD:param10} Datum->%{DATESTAMP_OTHER:param11}";
String logLine = "Bonsuche mit folgender Anfrage: Belegart->[EINGESCHRAENKTER_VERKAUF, VERKAUF, NACHERFASSUNG] " +
@ -439,4 +439,50 @@ public class GrokTests extends ESTestCase {
run.set(false);
assertThat(e.getMessage(), equalTo("grok pattern matching was interrupted after [200] ms"));
}
public void testAtInFieldName() {
assertGrokedField("@metadata");
}
public void assertNonAsciiLetterInFieldName() {
assertGrokedField("metädata");
}
public void assertSquareBracketInFieldName() {
assertGrokedField("metadat[a]");
assertGrokedField("metad[a]ta");
assertGrokedField("[m]etadata");
}
public void testUnderscoreInFieldName() {
assertGrokedField("meta_data");
}
public void testDotInFieldName() {
assertGrokedField("meta.data");
}
public void testMinusInFieldName() {
assertGrokedField("meta-data");
}
public void testAlphanumericFieldName() {
assertGrokedField(randomAlphaOfLengthBetween(1, 5));
assertGrokedField(randomAlphaOfLengthBetween(1, 5) + randomIntBetween(0, 100));
assertGrokedField(randomIntBetween(0, 100) + randomAlphaOfLengthBetween(1, 5));
assertGrokedField(String.valueOf(randomIntBetween(0, 100)));
}
public void testUnsupportedBracketsInFieldName() {
Grok grok = new Grok(basePatterns, "%{WORD:unsuppo(r)ted}");
Map<String, Object> matches = grok.captures("line");
assertNull(matches);
}
private void assertGrokedField(String fieldName) {
String line = "foo";
Grok grok = new Grok(basePatterns, "%{WORD:" + fieldName + "}");
Map<String, Object> matches = grok.captures(line);
assertEquals(line, matches.get(fieldName));
}
}