metaconfig: logstash: Support condition plugin

ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/profiles/server.pan

@@ -79,7 +79,11 @@ prefix "/software/components/metaconfig/services/{/etc/logstash/conf.d/logstash.
                 ),
             )),
         nlist("mutate", nlist(
-            "exclude_tags", list("_grokparsefailure"),
+            "_conditional", nlist('expr', list(nlist(
+                "left","'_grokparsefailure'",
+                "test", "not in",
+                "right", "[tags]",
+                ))),
             "replace", list(
                 nlist(
                     "name", "@source_host", 

ncm-metaconfig/src/main/metaconfig/logstash/2.0/tests/regexps/server/base

@@ -58,11 +58,12 @@ filter \{$
 ^\s{8}date \{$
 ^\s{12}match => \[ "syslog_timestamp", "yyyy-MM-dd'T'HH:mm:ss.SSSSSSZZ", "yyyy-MM-dd'T'HH:mm:ssZZ" \]$
 ^\s{8}\}$
-^\s{8}mutate \{$
-^\s{12}exclude_tags => \[ "_grokparsefailure" \]$
-^\s{12}replace => \{$
-^\s{16}"@source_host" => "%\{syslog_hostname\}"$
-^\s{16}"@message" => "%\{syslog_message\}"$
+^\s{8}if \('_grokparsefailure' not in \[tags\]\) \{$
+^\s{12}mutate \{$
+^\s{16}replace => \{$
+^\s{20}"@source_host" => "%\{syslog_hostname\}"$
+^\s{20}"@message" => "%\{syslog_message\}"$
+^\s{16}\}$
 ^\s{12}\}$
 ^\s{8}\}$
 ^\s{8}mutate \{$

ncm-metaconfig/src/main/metaconfig/logstash/config/conditional.tt

@@ -3,7 +3,7 @@
 [%-         IF block == first -%]
 [%-              type = 'if' -%]
 [%-         ELSIF block == last -%]
-[%-              type = 'if' -%]
+[%-              type = 'else' -%]
 [%-         ELSE -%]
 [%-              type = 'else if' -%]
 [%-         END -%]

ncm-metaconfig/src/main/metaconfig/logstash/config/plugins.tt

@@ -1,9 +1,15 @@
 [%- FOREACH plugin IN desc -%]
 [%- # there should be only one plugin
         FOREACH p IN plugin.pairs -%]
-[%          p.key %] {
-[%          INCLUDE "metaconfig/logstash/config/${section}/plugin.tt" desc=p.value FILTER indent %]
-[%          INCLUDE "metaconfig/logstash/config/${section}/${p.key}.tt" desc=p.value FILTER indent %]
+[%-         IF (p.value.exists('_conditional')) %]
+[%              p.value._conditional.type %] ([% INCLUDE "metaconfig/logstash/config/expression.tt" desc=p.value._conditional.expr %]) {
+[%          END -%]
+[%          FILTER indent(p.value.exists('_conditional') ? '    ' : '') -%]
+[%              p.key %] {
+[%              INCLUDE "metaconfig/logstash/config/${section}/plugin.tt" desc=p.value FILTER indent %]
+[%              INCLUDE "metaconfig/logstash/config/${section}/${p.key}.tt" desc=p.value FILTER indent %]
 }
+[%          END -%]
+[%          p.value.exists('_conditional') ? '}' : '' %]
 [%     END -%]
 [%- END -%]

ncm-metaconfig/src/main/metaconfig/logstash/pan/schema.pan

@@ -17,8 +17,27 @@ type logstash_ssl = {
     "ssl_verify" ? boolean
 };
 
+type logstash_conditional_expression = {
+    # [join] [[left] test] right (eg: and left > right; ! right;)
+    "join" ? string with match(SELF,'^(and|or|nand|xor)$')
+    "left" : string
+    "test" ? string with match(SELF,'^(==|!=|<|>|<=|>=|=~|!~|in|not in|!)$')
+    "right" ? string
+};
+
+# no nesting (yet)
+type logstash_conditional = {
+    # ifelseif: first one is 'if', rest is 'if else'
+    # ifelseifelse: first one is 'if', last is 'else', rest is 'if else'
+    "type" : string = 'if' with match(SELF, '^(if|if else|else|ifelseif|ifelseifelse)$')
+    "expr" : logstash_conditional_expression[]
+};
+
 @{ Common portion for all plugins }
 type logstash_plugin_common = {
+    @{using _conditional to avoid name clash with plugin option name.
+      The conditional is only for the single plugin and has to be type 'if' (the default).}
+    "_conditional" ? logstash_conditional with { if (SELF['type'] != 'if') {error('plugin _conditional has to be type if (the default)');}; true;}
 };
 
 # list not complete at all
@@ -131,7 +150,7 @@ type logstash_filter_grok = {
     include logstash_filter_plugin_common
     "match" ? logstash_name_pattern[]
     "break_on_match" : boolean = true
-    "drop_if_match" ? boolean 
+    "drop_if_match" ? boolean
     "keep_empty_captures" ? boolean
     "named_captures_only" : boolean = true
     "patterns_dir" ? string[]
@@ -159,7 +178,7 @@ type logstash_filter_mutate = {
     "replace" ? logstash_name_pattern[]
     "rename" ? string{}
     "split" ? string{}
-    "exclude_tags" ? string[] # DEPRECATED, should be replaced by conditional block
+    "exclude_tags" ? string[] with {deprecated(0, 'replace with _conditional e.g. <"tagname" not in [tags]> in 2.0'); true;}
 };
 
 type logstash_filter_kv = {
@@ -235,22 +254,6 @@ type logstash_output_plugin = {
     "elasticsearch" ? logstash_output_elasticsearch
 } with length(SELF) == 1;
 
-type logstash_conditional_expression = {
-    # [join] [[left] test] right (eg: and left > right; ! right;)
-    "join" ? string with match(SELF,'^(and|or|nand|xor)$')
-    "left" : string
-    "test" ? string with match(SELF,'^(==|!=|<|>|<=|>=|=~|!~|in|not in|!)$')
-    "right" ? string
-};
-
-# no nesting (yet)
-type logstash_conditional = {
-    # ifelseif: first one is 'if', rest is 'if else'
-    # ifelseifelse: first one is 'if', last is 'else', rest is 'if else'
-    "type" : string with match(SELF, '^(if|if else|else|ifelseif|ifelseifelse)$')
-    "expr" : logstash_conditional_expression[]
-};
-
 type logstash_input_conditional = {
     include logstash_conditional
     "plugins" ? logstash_input_plugin[]
@@ -268,17 +271,17 @@ type logstash_output_conditional = {
 
 type logstash_input = {
     "plugins" ? logstash_input_plugin[]
-    "conditionals" ? logstash_input_conditional[] 
+    "conditionals" ? logstash_input_conditional[]
 };
 
 type logstash_filter = {
     "plugins" ? logstash_filter_plugin[]
-    "conditionals" ? logstash_filter_conditional[] 
+    "conditionals" ? logstash_filter_conditional[]
 };
 
 type logstash_output = {
     "plugins" ? logstash_output_plugin[]
-    "conditionals" ? logstash_output_conditional[] 
+    "conditionals" ? logstash_output_conditional[]
 };
 
 @{ The configuration is made of input, filter and output section }