IP2Proxy Filter Plugin

This is IP2Proxy filter plugin for Logstash that enables Logstash's users to reverse search of IP address to detect VPN servers, open proxies, web proxies, Tor exit nodes, search engine robots, data center ranges and residential proxies using IP2Proxy BIN database. Other information available includes proxy type, country, state, city, ISP, domain name, usage type, AS number, AS name, threats, last seen date and provider names. The library took the proxy IP address from IP2Proxy BIN Data file.

For the methods to use IP2Proxy filter plugin with Elastic Stack (Elasticsearch, Filebeat, Logstash, and Kibana), please take a look on this tutorial.

Dependencies (IP2PROXY BIN DATA FILE)

This plugin requires IP2Proxy BIN data file to function. You may download the BIN data file at

Installation

Install this plugin by the following code:

bin/logstash-plugin install logstash-filter-ip2proxy

Config File Example

input {
  beats {
    port => "5043"
  }
}

filter {
  grok {
    match => { "message" => "%{COMBINEDAPACHELOG}"}
  }
  ip2proxy {
    source => "clientip"
  }
}

output {
  elasticsearch {
    hosts => [ "localhost:9200" ]
  }
}

IP2Proxy Filter Configuration

Setting Input type Required
source string Yes
database a valid filesystem path No
  • source field is a required setting that containing the IP address or hostname to get the ip information.
  • database field is an optional setting that containing the path to the IP2Proxy BIN database file.

Sample Output

Field Description
ip2proxy.as the autonomous system (AS) name of proxy's IP address or domain name
ip2proxy.asn the autonomous system number (ASN) of proxy's IP address or domain name
ip2proxy.city the city name of the proxy
ip2proxy.country_long the ISO3166-1 country name of the proxy
ip2proxy.country_short the ISO3166-1 country code (two-characters) of the proxy
ip2proxy.domain the domain name of proxy's IP address or domain name
ip2proxy.is_proxy Check whether if an IP address was a proxy. Returned value:
  • -1 : errors
  • 0 : not a proxy
  • 1 : a proxy
  • 2 : a data center IP address
ip2proxy.isp the ISP name of the proxy
ip2proxy.last_seen the last seen days ago value of proxy's IP address or domain name
ip2proxy.provider the VPN service provider name if available
ip2proxy.proxy_type the proxy type. Please visit IP2Location for the list of proxy types supported
ip2proxy.region the ISO3166-2 region name of the proxy. Please visit ISO3166-2 Subdivision Code for the information of ISO3166-2 supported
ip2proxy.thread the threat type of the proxy
ip2proxy.usage_type the usage type classification of the proxy. Please visit IP2Location for the list of usage types supported

Support

Email: support@ip2location.com

URL: https://www.ip2location.com