initial
initial
almost ready to try
not yet working
problems remain structuring the json, switching to jiralicious shortly
Basically works
jiralicious
attributions
updated sample
Closed https://github.com/jstewart/jiralicious/issues/17
Use Cabin (see LOGSTASH-238).
Adding extractnumbers filter
Pull in BinData gem for parsing Netflow packets.
Add Netflow input plugin, currently supporting v5:

- A log event is created for each flow record in a received packet. @fields
  contains all of the fields in the flow records plus some of the ones found
  in the global header.

- @timestamp is taken from the epoch seconds/nanoseconds provided in the
  flowset header.

- IP address fields are converted from uint32 to dotted quad.

- First/Last switched records are converted from device uptime milliseconds
  into a UTC timestamp.
Require at least BinData 1.5.0 for needed functionality.
Add v9 support to Netflow input plugin:

- Implemented v9 fields 1-45, 56, 57, 80, 81.

- MAC address fields are converted to aa:bb:cc:dd:ee:ff form.

- Implement v5 pad fields with skip type.
Small typo.
Make some of the record fields less verbose.
Fix parsing options templates.

- Additionally, it seems the flow_records header field refers to the number
  of flow records across all flowsets, _not_ the number of flowsets so change
  the records array to read until EOF.
Explicitly handle field length defaults.

So it appears some devices just send a length of 0 for variable size fields
where the default is to be assumed, requiring the collector to hopefully
use the right value.