From a90afd95c6ff204f6ee6f4544a34f379fceec8a0 Mon Sep 17 00:00:00 2001
From: Cameron Sparr <cameronsparr@gmail.com>
Date: Tue, 20 Dec 2016 15:57:32 +0000
Subject: [PATCH] Fix & unit test logparser CLF pattern with IPv6
deals partially with #1973
see also https://github.com/vjeantet/grok/issues/17
---
CHANGELOG.md | 1 +
plugins/inputs/logparser/grok/grok_test.go | 40 +++++++++++++++++++
.../inputs/logparser/grok/influx_patterns.go | 2 +-
3 files changed, 42 insertions(+), 1 deletion(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b228a891..a444b19c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -50,6 +50,7 @@ in their config file.
- [#2089](https://github.com/influxdata/telegraf/issues/2089): Fix tail input when reading from a pipe.
- [#1449](https://github.com/influxdata/telegraf/issues/1449): MongoDB plugin always shows 0 replication lag.
- [#1825](https://github.com/influxdata/telegraf/issues/1825): Consul plugin: add check_id as a tag in metrics to avoid overwrites.
+- [#1973](https://github.com/influxdata/telegraf/issues/1973): Partial fix: logparser CLF pattern with IPv6 addresses.
## v1.1.2 [2016-12-12]
diff --git a/plugins/inputs/logparser/grok/grok_test.go b/plugins/inputs/logparser/grok/grok_test.go
index 105cc048..1344896b 100644
--- a/plugins/inputs/logparser/grok/grok_test.go
+++ b/plugins/inputs/logparser/grok/grok_test.go
@@ -82,6 +82,46 @@ func TestMeasurementName(t *testing.T) {
assert.Equal(t, "my_web_log", m.Name())
}
+func TestCLF_IPv6(t *testing.T) {
+ p := &Parser{
+ Measurement: "my_web_log",
+ Patterns: []string{"%{COMMON_LOG_FORMAT}"},
+ }
+ assert.NoError(t, p.Compile())
+
+ m, err := p.ParseLine(`2001:0db8:85a3:0000:0000:8a2e:0370:7334 user-identifier frank [10/Oct/2000:13:55:36 -0700] "GET /apache_pb.gif HTTP/1.0" 200 2326`)
+ require.NotNil(t, m)
+ assert.NoError(t, err)
+ assert.Equal(t,
+ map[string]interface{}{
+ "resp_bytes": int64(2326),
+ "auth": "frank",
+ "client_ip": "2001:0db8:85a3:0000:0000:8a2e:0370:7334",
+ "http_version": float64(1.0),
+ "ident": "user-identifier",
+ "request": "/apache_pb.gif",
+ },
+ m.Fields())
+ assert.Equal(t, map[string]string{"verb": "GET", "resp_code": "200"}, m.Tags())
+ assert.Equal(t, "my_web_log", m.Name())
+
+ m, err = p.ParseLine(`::1 user-identifier frank [10/Oct/2000:13:55:36 -0700] "GET /apache_pb.gif HTTP/1.0" 200 2326`)
+ require.NotNil(t, m)
+ assert.NoError(t, err)
+ assert.Equal(t,
+ map[string]interface{}{
+ "resp_bytes": int64(2326),
+ "auth": "frank",
+ "client_ip": "::1",
+ "http_version": float64(1.0),
+ "ident": "user-identifier",
+ "request": "/apache_pb.gif",
+ },
+ m.Fields())
+ assert.Equal(t, map[string]string{"verb": "GET", "resp_code": "200"}, m.Tags())
+ assert.Equal(t, "my_web_log", m.Name())
+}
+
func TestCustomInfluxdbHttpd(t *testing.T) {
p := &Parser{
Patterns: []string{`\[httpd\] %{COMBINED_LOG_FORMAT} %{UUID:uuid:drop} %{NUMBER:response_time_us:int}`},
diff --git a/plugins/inputs/logparser/grok/influx_patterns.go b/plugins/inputs/logparser/grok/influx_patterns.go
index 05279114..1b115dad 100644
--- a/plugins/inputs/logparser/grok/influx_patterns.go
+++ b/plugins/inputs/logparser/grok/influx_patterns.go
@@ -56,7 +56,7 @@ EXAMPLE_LOG \[%{HTTPDATE:ts:ts-httpd}\] %{NUMBER:myfloat:float} %{RESPONSE_CODE}
NGUSERNAME [a-zA-Z0-9\.\@\-\+_%]+
NGUSER %{NGUSERNAME}
# Wider-ranging client IP matching
-CLIENT (?:%{IPORHOST}|%{HOSTPORT}|::1)
+CLIENT (?:%{IPV6}|%{IPV4}|%{HOSTNAME}|%{HOSTPORT})
##
## COMMON LOG PATTERNS
--
GitLab