Skip to content

Commit 883d474

Browse files
committed
Update grok patterns to use HOSTNAME in stead of HOST
Pre v2.0.0 logstash included both `HOST` and `HOSTNAME` patterns in baseline, where `HOST` was actually just an alias for `HOSTNAME`. In v2.0.0 the `HOST` alias was dropped, so we need to use `HOSTNAME` now. Thanks to https://github.com/moebiuseye for mentioning in #70
1 parent 8f1a2e3 commit 883d474

File tree

5 files changed

+8
-8
lines changed

5 files changed

+8
-8
lines changed

.gitmodules

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
[submodule "test/logstash"]
2-
path = test/logstash
3-
url = https://github.com/elasticsearch/logstash.git
1+
[submodule "test/logstash-patterns-core"]
2+
path = test/logstash-patterns-core
3+
url = https://github.com/logstash-plugins/logstash-patterns-core.git

postfix.grok

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# common postfix patterns
22
POSTFIX_QUEUEID ([0-9A-F]{6,}|[0-9a-zA-Z]{15,}|NOQUEUE)
3-
POSTFIX_CLIENT_INFO %{HOST:postfix_client_hostname}?\[%{IP:postfix_client_ip}\](:%{INT:postfix_client_port})?
4-
POSTFIX_RELAY_INFO %{HOST:postfix_relay_hostname}?\[(%{IP:postfix_relay_ip}|%{DATA:postfix_relay_service})\](:%{INT:postfix_relay_port})?|%{WORD:postfix_relay_service}
3+
POSTFIX_CLIENT_INFO %{HOSTNAME:postfix_client_hostname}?\[%{IP:postfix_client_ip}\](:%{INT:postfix_client_port})?
4+
POSTFIX_RELAY_INFO %{HOSTNAME:postfix_relay_hostname}?\[(%{IP:postfix_relay_ip}|%{DATA:postfix_relay_service})\](:%{INT:postfix_relay_port})?|%{WORD:postfix_relay_service}
55
POSTFIX_SMTP_STAGE (CONNECT|HELO|EHLO|STARTTLS|AUTH|MAIL|RCPT( TO)?|(end of )?DATA|RSET|UNKNOWN|END-OF-MESSAGE|VRFY|\.)
66
POSTFIX_ACTION (reject|defer|accept|header-redirect)
77
POSTFIX_STATUS_CODE \d{3}
@@ -50,7 +50,7 @@ POSTFIX_PS_CACHE cache %{DATA} full cleanup: retained=%{NUMBER:postfix_postscree
5050
POSTFIX_PS_VIOLATIONS %{POSTFIX_PS_VIOLATION:postfix_postscreen_violation}( %{INT})?( after %{NUMBER:postfix_postscreen_violation_time})? from %{POSTFIX_CLIENT_INFO}( after %{POSTFIX_SMTP_STAGE:postfix_smtp_stage})?
5151

5252
# dnsblog patterns
53-
POSTFIX_DNSBLOG_LISTING addr %{IP:postfix_client_ip} listed by domain %{HOST:postfix_dnsbl_domain} as %{IP:postfix_dnsbl_result}
53+
POSTFIX_DNSBLOG_LISTING addr %{IP:postfix_client_ip} listed by domain %{HOSTNAME:postfix_dnsbl_domain} as %{IP:postfix_dnsbl_result}
5454

5555
# tlsproxy patterns
5656
POSTFIX_TLSPROXY_CONN (DIS)?CONNECT( from)? %{POSTFIX_CLIENT_INFO}

test/logstash

-1
This file was deleted.

test/logstash-patterns-core

Submodule logstash-patterns-core added at 53bb945

test/test.rb

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
class TestGrokPatterns < MiniTest::Unit::TestCase
1616

1717
@@test_dir = File.dirname(__FILE__)
18-
@@upstream_pattern_dir = @@test_dir + '/logstash/patterns'
18+
@@upstream_pattern_dir = @@test_dir + '/logstash-patterns-core/patterns'
1919
@@local_pattern_dir = File.dirname(File.expand_path(@@test_dir))
2020

2121
# Prepare a grok object.

0 commit comments

Comments
 (0)