Class: LogStash::Filters::Greynoise

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/greynoise.rb

Overview

This filter will replace the contents of the default message field with whatever you specify in the configuration.

It is only intended to be used as an .

Instance Method Summary collapse

Instance Method Details

#filter(event) ⇒ Object 



81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
 
# File 'lib/logstash/filters/greynoise.rb', line 81

def filter(event)
  valid = nil
  begin
    IPAddr.new(event.sprintf(ip))
  rescue ArgumentError => e
    valid = e
  end

  if valid
    @logger.error("Invalid IP address, skipping", :ip => event.sprintf(ip), :event => event.to_hash)
    event.tag(@tag_on_failure)
  else
    if @hit_cache
      result = @hit_cache[event.sprintf(ip)]
      if result
        event.set(@target, result)
        filter_matched(event)
      else
        # check if api key exists and has len of 25 or more to prevent forbidden response
        if @key.length >= 25
          result = get_enterprise(event.sprintf(ip), event.sprintf(key))
          # if no key then use alpha(free) api
        else
          result = get_free(event.sprintf(ip))
        end
        unless result.nil?
          @hit_cache[event.sprintf(ip)] = result
          event.set(@target, result)
          # filter_matched should go in the last line of our successful code
          filter_matched(event)
        end
      end
    else
      if @key.length >= 25
        result = get_enterprise(event.sprintf(ip), event.sprintf(key))
      else
        result = get_free(event.sprintf(ip))
      end

      unless result.nil?
        event.set(@target, result)
        filter_matched(event)
      end
    end
  end
end

#register ⇒ Object 



47
48
49
50
51
52
 
# File 'lib/logstash/filters/greynoise.rb', line 47

def register
  if @hit_cache_size > 0
    @hit_cache = LruRedux::TTL::ThreadSafeCache.new(@hit_cache_size, @hit_cache_ttl)
  end

end