Class: Fluent::ModsecurityFilter

Inherits:
Filter
  • Object
show all
Defined in:
lib/fluent/plugin/filter_modsecurity.rb

Instance Method Summary collapse

Instance Method Details

#configure(conf) ⇒ Object 



11
12
13
14
 
# File 'lib/fluent/plugin/filter_modsecurity.rb', line 11

def configure(conf)
    super
    @path_prefix = conf['path_prefix']
end

#filter(tag, time, record) ⇒ Object 



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/fluent/plugin/filter_modsecurity.rb', line 16

def filter(tag, time, record)
    log_path = ""
    record.each{ |key, value|
        if value.is_a?(String)
            token = value.split(" ")
            token.each { |v|
                if v.start_with?(@path_prefix)
                    log_path = v
                    break
                end
            }
        end
    }
    #find detail log and append to record
    unless log_path.to_s.strip.empty?
        file = File.read(log_path)
        data_hash = JSON.parse(file)
        #copy transaction object to original record
        record['transaction'] = data_hash['transaction']
    end
    record
end