Class: LogStash::Codecs::IPFIX

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/codecs/ipfix.rb

Constant Summary collapse

IPFIX10_FIELDS = 
%w{ export_time sequence_number observation_domain_id }

Instance Method Summary collapse

Constructor Details

#initialize(params = {}) ⇒ IPFIX

Returns a new instance of IPFIX.



41
42
43
44
 
# File 'lib/logstash/codecs/ipfix.rb', line 41

def initialize(params = {})
  super(params)
  @threadsafe = false
end

Instance Method Details

#decode(payload, &block) ⇒ Object 



72
73
74
75
76
77
78
79
80
81
82
83
 
# File 'lib/logstash/codecs/ipfix.rb', line 72

def decode(payload, &block)
  message_header = Header.read(payload)

  if message_header.version_number == 10
    flowset = IPFIXSet.read(payload)
    flowset.records.each do |record|
      decode_ipfix10(flowset, record).each{|event| yield(event)}
    end
  else
    @logger.warn("Unsupported IPFIX version v#{header.version}")
  end
end

#register ⇒ Object 



47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
 
# File 'lib/logstash/codecs/ipfix.rb', line 47

def register
  @templates = Vash.new

  # Path to default field definitions
  filename = ::File.expand_path('IPFIX/ipfix.yaml', ::File.dirname(__FILE__))

  begin
    @fields = YAML.load_file(filename)
  rescue Exception => e
    raise "#{self.class.name}: Bad syntax in definitions file #{filename}: " + e.message
  end

  # Allow the user to supply enterprise fields
  if @definitions
    raise "#{self.class.name}: definitions file #{@definitions} does not exist" unless File.exists?(@definitions)
    begin
      @enterprise_fields = YAML.load_file(@definitions)
      @logger.debug? and @logger.debug('Enterprise fields: ', @enterprise_fields)
    rescue Exception => e
      raise "#{self.class.name}: Bad syntax in definitions file #{@definitions}: " + e.message
    end
  end
end