From 895556db011c6de1fd919702caf32738d9433a5f Mon Sep 17 00:00:00 2001 From: Shizuo Fujita Date: Fri, 9 Oct 2026 10:01:32 +0900 Subject: [PATCH 1/3] Add .gitignore Signed-off-by: Shizuo Fujita --- .gitignore | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..98ec5b4 --- /dev/null +++ b/.gitignore @@ -0,0 +1,5 @@ +/.bundle/ +/Gemfile.lock +/pkg/ +/vendor/bundle/ +*.gem From 8add8241f5d4a1ad6cbbc397bbc29c0e4b856e87 Mon Sep 17 00:00:00 2001 From: Shizuo Fujita Date: Fri, 9 Oct 2026 10:04:56 +0900 Subject: [PATCH 2/3] Update patterns git submodule foreach git pull --rebase origin main bundle exec rake patterns:import Signed-off-by: Shizuo Fujita --- patterns/ecs-v1/aws | 7 ++++++- patterns/ecs-v1/bind | 2 +- patterns/ecs-v1/firewalls | 2 +- vendor/logstash-patterns-core | 2 +- 4 files changed, 9 insertions(+), 4 deletions(-) diff --git a/patterns/ecs-v1/aws b/patterns/ecs-v1/aws index a99443d..8703445 100644 --- a/patterns/ecs-v1/aws +++ b/patterns/ecs-v1/aws @@ -19,8 +19,13 @@ ELB_V1_HTTP_LOG %{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE:[aws][elb][name]} %{IP ELB_ACCESS_LOG %{ELB_V1_HTTP_LOG} +# Each edge location is identified by a three-letter code and an arbitrarily assigned number. +# The three-letter IATA code typically represents an airport near the edge location. +# examples: "LHR62-C2", "SFO5-P1", ""IND6", "CPT50" +CLOUDFRONT_EDGE_LOCATION [A-Z]{3}[0-9]{1,2}(?:-[A-Z0-9]{2})? + # pattern used to match a shorted format, that's why we have the optional part (starting with *http.version*) at the end -CLOUDFRONT_ACCESS_LOG (?%{YEAR}-%{MONTHNUM}-%{MONTHDAY}\t%{TIME})\t%{WORD:[aws][cloudfront][x_edge_location]}\t(?:-|%{INT:[destination][bytes]:integer})\t%{IPORHOST:[source][ip]}\t%{WORD:[http][request][method]}\t%{HOSTNAME:[url][domain]}\t%{NOTSPACE:[url][path]}\t(?:(?:000)|%{INT:[http][response][status_code]:integer})\t(?:-|%{DATA:[http][request][referrer]})\t%{DATA:[user_agent][original]}\t(?:-|%{DATA:[url][query]})\t(?:-|%{DATA:[aws][cloudfront][http][request][cookie]})\t%{WORD:[aws][cloudfront][x_edge_result_type]}\t%{NOTSPACE:[aws][cloudfront][x_edge_request_id]}\t%{HOSTNAME:[aws][cloudfront][http][request][host]}\t%{URIPROTO:[network][protocol]}\t(?:-|%{INT:[source][bytes]:integer})\t%{NUMBER:[aws][cloudfront][time_taken]:float}\t(?:-|%{IP:[network][forwarded_ip]})\t(?:-|%{DATA:[aws][cloudfront][ssl_protocol]})\t(?:-|%{NOTSPACE:[tls][cipher]})\t%{WORD:[aws][cloudfront][x_edge_response_result_type]}(?:\t(?:-|HTTP/%{NUMBER:[http][version]})\t(?:-|%{DATA:[aws][cloudfront][fle_status]})\t(?:-|%{DATA:[aws][cloudfront][fle_encrypted_fields]})\t%{INT:[source][port]:integer}\t%{NUMBER:[aws][cloudfront][time_to_first_byte]:float}\t(?:-|%{DATA:[aws][cloudfront][x_edge_detailed_result_type]})\t(?:-|%{NOTSPACE:[http][request][mime_type]})\t(?:-|%{INT:[aws][cloudfront][http][request][size]:integer})\t(?:-|%{INT:[aws][cloudfront][http][request][range][start]:integer})\t(?:-|%{INT:[aws][cloudfront][http][request][range][end]:integer}))? +CLOUDFRONT_ACCESS_LOG (?%{YEAR}-%{MONTHNUM}-%{MONTHDAY}\t%{TIME})\t%{CLOUDFRONT_EDGE_LOCATION:[aws][cloudfront][x_edge_location]}\t(?:-|%{INT:[destination][bytes]:integer})\t%{IPORHOST:[source][ip]}\t%{WORD:[http][request][method]}\t%{HOSTNAME:[url][domain]}\t%{NOTSPACE:[url][path]}\t(?:(?:000)|%{INT:[http][response][status_code]:integer})\t(?:-|%{DATA:[http][request][referrer]})\t%{DATA:[user_agent][original]}\t(?:-|%{DATA:[url][query]})\t(?:-|%{DATA:[aws][cloudfront][http][request][cookie]})\t%{WORD:[aws][cloudfront][x_edge_result_type]}\t%{NOTSPACE:[aws][cloudfront][x_edge_request_id]}\t%{HOSTNAME:[aws][cloudfront][http][request][host]}\t%{URIPROTO:[network][protocol]}\t(?:-|%{INT:[source][bytes]:integer})\t%{NUMBER:[aws][cloudfront][time_taken]:float}\t(?:-|%{IP:[network][forwarded_ip]})\t(?:-|%{DATA:[aws][cloudfront][ssl_protocol]})\t(?:-|%{NOTSPACE:[tls][cipher]})\t%{WORD:[aws][cloudfront][x_edge_response_result_type]}(?:\t(?:-|HTTP/%{NUMBER:[http][version]})\t(?:-|%{DATA:[aws][cloudfront][fle_status]})\t(?:-|%{DATA:[aws][cloudfront][fle_encrypted_fields]})\t%{INT:[source][port]:integer}\t%{NUMBER:[aws][cloudfront][time_to_first_byte]:float}\t(?:-|%{DATA:[aws][cloudfront][x_edge_detailed_result_type]})\t(?:-|%{NOTSPACE:[http][request][mime_type]})\t(?:-|%{INT:[aws][cloudfront][http][request][size]:integer})\t(?:-|%{INT:[aws][cloudfront][http][request][range][start]:integer})\t(?:-|%{INT:[aws][cloudfront][http][request][range][end]:integer}))? # :long - %{INT:[destination][bytes]:int} # :long - %{INT:[source][bytes]:int} # :long - %{INT:[aws][cloudfront][http][request][size]:int} diff --git a/patterns/ecs-v1/bind b/patterns/ecs-v1/bind index b33236a..cb9ab7b 100644 --- a/patterns/ecs-v1/bind +++ b/patterns/ecs-v1/bind @@ -8,6 +8,6 @@ BIND9_CATEGORY (?:queries) BIND9_QUERYLOGBASE client(:? @0x(?:[0-9A-Fa-f]+))? %{IP:[client][ip]}#%{POSINT:[client][port]:integer} \(%{GREEDYDATA:[bind][log][question][name]}\): query: %{GREEDYDATA:[dns][question][name]} (?<[dns][question][class]>IN) %{BIND9_DNSTYPE:[dns][question][type]}(:? %{DATA:[bind][log][question][flags]})? \(%{IP:[server][ip]}\) # for query-logging category and severity are always fixed as "queries: info: " -BIND9_QUERYLOG %{BIND9_TIMESTAMP:timestamp} %{BIND9_CATEGORY:[bing][log][category]}: %{LOGLEVEL:[log][level]}: %{BIND9_QUERYLOGBASE} +BIND9_QUERYLOG %{BIND9_TIMESTAMP:timestamp} %{BIND9_CATEGORY:[bind][log][category]}: %{LOGLEVEL:[log][level]}: %{BIND9_QUERYLOGBASE} BIND9 %{BIND9_QUERYLOG} diff --git a/patterns/ecs-v1/firewalls b/patterns/ecs-v1/firewalls index fd976b4..b6e9e5a 100644 --- a/patterns/ecs-v1/firewalls +++ b/patterns/ecs-v1/firewalls @@ -60,7 +60,7 @@ CISCOFW110002 %{CISCO_REASON:[event][reason]} for %{WORD:[cisco][asa][network][t # ASA-6-302010 CISCOFW302010 %{INT:[cisco][asa][connections][in_use]:integer} in use, %{INT:[cisco][asa][connections][most_used]:integer} most used # ASA-6-302013, ASA-6-302014, ASA-6-302015, ASA-6-302016 -CISCOFW302013_302014_302015_302016 %{CISCO_ACTION:[cisco][asa][outcome]}(?: %{CISCO_DIRECTION:[cisco][asa][network][direction]})? %{WORD:[cisco][asa][network][transport]} connection %{INT:[cisco][asa][connection_id]} for %{NOTSPACE:[observer][ingress][interface][name]}:%{IP:[source][ip]}/%{INT:[source][port]:integer}(?: \(%{IP:[source][nat][ip]}/%{INT:[source][nat][port]:integer}\))?(?:\(%{DATA:[source][user][name?]}\))? to %{NOTSPACE:[observer][egress][interface][name]}:%{IP:[destination][ip]}/%{INT:[destination][port]:integer}( \(%{IP:[destination][nat][ip]}/%{INT:[destination][nat][port]:integer}\))?(?:\(%{DATA:[destination][user][name]}\))?( duration %{TIME:[cisco][asa][duration]} bytes %{INT:[network][bytes]:integer})?(?: %{CISCO_REASON:[event][reason]})?(?: \(%{DATA:[user][name]}\))? +CISCOFW302013_302014_302015_302016 %{CISCO_ACTION:[cisco][asa][outcome]}(?: %{CISCO_DIRECTION:[cisco][asa][network][direction]})? %{WORD:[cisco][asa][network][transport]} connection %{INT:[cisco][asa][connection_id]} for %{NOTSPACE:[observer][ingress][interface][name]}:%{IP:[source][ip]}/%{INT:[source][port]:integer}(?: \(%{IP:[source][nat][ip]}/%{INT:[source][nat][port]:integer}\))?(?:\(%{DATA:[source][user][name]}\))? to %{NOTSPACE:[observer][egress][interface][name]}:%{IP:[destination][ip]}/%{INT:[destination][port]:integer}( \(%{IP:[destination][nat][ip]}/%{INT:[destination][nat][port]:integer}\))?(?:\(%{DATA:[destination][user][name]}\))?( duration %{TIME:[cisco][asa][duration]} bytes %{INT:[network][bytes]:integer})?(?: %{CISCO_REASON:[event][reason]})?(?: \(%{DATA:[user][name]}\))? # :long - %{INT:[network][bytes]:int} # ASA-6-302020, ASA-6-302021 CISCOFW302020_302021 %{CISCO_ACTION:[cisco][asa][outcome]}(?: %{CISCO_DIRECTION:[cisco][asa][network][direction]})? %{WORD:[cisco][asa][network][transport]} connection for faddr %{IP:[destination][ip]}/%{INT:[cisco][asa][icmp_seq]:integer}(?:\(%{DATA:[destination][user][name]}\))? gaddr %{IP:[source][nat][ip]}/%{INT:[cisco][asa][icmp_type]:integer} laddr %{IP:[source][ip]}/%{INT}(?: \(%{DATA:[source][user][name]}\))? diff --git a/vendor/logstash-patterns-core b/vendor/logstash-patterns-core index 7f94275..74a4098 160000 --- a/vendor/logstash-patterns-core +++ b/vendor/logstash-patterns-core @@ -1 +1 @@ -Subproject commit 7f94275ec8212f7f0aa6eb4ac5dbf3d70cd05cac +Subproject commit 74a4098582d3331a2b9b18c04d2446f2c0efb648 From b81243503ea0cdc85907a91240ef6600edd5a97f Mon Sep 17 00:00:00 2001 From: Shizuo Fujita Date: Fri, 9 Oct 2026 10:07:31 +0900 Subject: [PATCH 3/3] Bump up version to 2.6.3 Signed-off-by: Shizuo Fujita --- fluent-plugin-grok-parser.gemspec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fluent-plugin-grok-parser.gemspec b/fluent-plugin-grok-parser.gemspec index 3a3e38e..558b4a0 100644 --- a/fluent-plugin-grok-parser.gemspec +++ b/fluent-plugin-grok-parser.gemspec @@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib) Gem::Specification.new do |spec| spec.name = "fluent-plugin-grok-parser" - spec.version = "2.6.2" + spec.version = "2.6.3" spec.authors = ["kiyoto", "Kenji Okimoto"] spec.email = ["kiyoto@treasure-data.com", "okimoto@clear-code.com"] spec.summary = %q{Fluentd plugin to support Logstash-inspired Grok format for parsing logs}