Class: Fluent::Plugin::TwistlockSyslogFilter

Inherits:
Filter
  • Object
show all
Defined in:
lib/fluent/plugin/filter_twistlock_syslog.rb

Instance Method Summary collapse

Instance Method Details

#configure(conf) ⇒ Object 



11
12
13
14
15
16
 
# File 'lib/fluent/plugin/filter_twistlock_syslog.rb', line 11

def configure(conf)
  super
  unless File.file?(@key_path)
    raise Fluent::ConfigError, "Private key file must be present. #{@key_path} Please check."
  end
end

#filter(tag, time, record) ⇒ Object 



21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/fluent/plugin/filter_twistlock_syslog.rb', line 21

def filter(tag, time, record)
  message = record[@key_name][0..-2]
  begin
    message.split(/(?<!\\|=)"\s/).each { |in_msg|
      keymap = in_msg.split('="')
      record[keymap[0]] = keymap[1]
    }
    record.delete("ident")
    record.delete("pid")
    record.delete("time")
    if record.key?("host_name")
      record["host"] = record["host_name"]
      record.delete("host_name")
    end
    signature = @private_key.sign(OpenSSL::Digest::SHA256.new, record[@key_name])
    record['checksum_signature'] = Base64.encode64(signature)
  rescue Exception => e
    log.warn "Unable to map record with message=#{record[@key_name]}"
    log.warn e.backtrace.inspect
  end
  record
end

#start ⇒ Object 



17
18
19
20
 
# File 'lib/fluent/plugin/filter_twistlock_syslog.rb', line 17

def start
  super
  @private_key = OpenSSL::PKey::RSA.new(File.read(@key_path))
end