Skip to content

Commit 54b7ad8

Browse files
authored
Compatibility with Logstash 7.2
Previous version didn' t work for me in logstash 7. The to_hash method was not found and also not needed as the above split already creates an array.
1 parent 93b5927 commit 54b7ad8

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

2110_filter_section_k_parse_matchedRules.conf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ filter {
1414
# hack.. @see https://logstash.jira.com/browse/LOGSTASH-1331
1515
mutate {
1616
gsub => [ "rawSectionK", "\n", "~" ]
17+
gsub => [ "rawSectionK", "(~+)", "~" ]
1718
split => [ "rawSectionK" , "~" ]
1819
}
1920

@@ -24,7 +25,7 @@ filter {
2425
ruby {
2526
code => "
2627
secRuleIds = Array.new()
27-
matchedRules_array = event.get('matchedRules').to_hash
28+
matchedRules_array = event.get('matchedRules')
2829
matchedRules_array.each do |entry|
2930
if entry.match(/^SecRule /) and entry.match(/,id:/)
3031
secRuleIds.push(/,id:(?<ruleId>\d+)/.match(entry)[:ruleId])

0 commit comments

Comments
 (0)