Class: LogStash::Inputs::AkamaiSiem

Inherits:
Base
  • Object
show all
Extended by:
PluginMixins::ValidatorSupport::FieldReferenceValidationAdapter
Includes:
PluginMixins::ECSCompatibilitySupport::TargetCheck, PluginMixins::EventSupport::EventFactoryAdapter, PluginMixins::EventSupport::FromJsonHelper, PluginMixins::Scheduler
Defined in:
lib/logstash/inputs/akamai_siem/exception.rb,
lib/logstash/inputs/akamai_siem/request.rb,
lib/logstash/inputs/akamai_siem.rb

Defined Under Namespace

Classes: Exception, Request

Constant Summary collapse

QUERY_PARAMETERS = 
[
%w[offset],
%w[offset limit],
%w[from],
%w[from limit],
%w[from to],
%w[from to limit],

Instance Attribute Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#template ⇒ Object (readonly)

Returns the value of attribute template.



80
81
82
 
# File 'lib/logstash/inputs/akamai_siem.rb', line 80

def template
  @template
end

Instance Method Details

#close ⇒ Object 



103
104
105
 
# File 'lib/logstash/inputs/akamai_siem.rb', line 103

def close
  close_client
end

#register ⇒ Object 



83
84
85
86
87
88
89
90
91
92
93
94
95
 
# File 'lib/logstash/inputs/akamai_siem.rb', line 83

def register
  @host = Socket.gethostname.force_encoding(Encoding::UTF_8)
  @offset = nil
  @from = nil
  @to = nil
  @limit = nil

  @template = Addressable::Template.new(File.join(base_url, "siem/v1/configs", "{configs_ids}", "{?query*}"))

  setup_ecs_field!
  query_validation!
  # LogStash::Logging::Logger::configure_logging('debug')
end

#run(queue) ⇒ Object 



159
160
161
 
# File 'lib/logstash/inputs/akamai_siem.rb', line 159

def run(queue)
  setup_schedule(queue)
end

#run_once(queue) ⇒ Object 



177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
 
# File 'lib/logstash/inputs/akamai_siem.rb', line 177

def run_once(queue)
  url = template.expand({
                    "configs_ids" => configs_ids.join(';'),
                    "query" => normalize_query,
                  },
  )


  timestamp = eg_timestamp
  nonce = new_nonce
  headers.update({
    "accept" => "application/json",
  })
  options = {}
  method = 'get'

  request = build_request(method) do |req|
    req.update_uri(url)         if url
    req.headers.update(headers) if headers
    yield(req) if block_given?
  end

  request[KEY] = make_auth_header(request, timestamp, nonce)

  request_async(
    queue,
    request
  )
  client.execute! unless stop?
end

#setup_schedule(queue) ⇒ Object

Raises:

  • (Logstash::ConfigurationError) 


163
164
165
166
167
168
169
170
171
172
173
174
175
 
# File 'lib/logstash/inputs/akamai_siem.rb', line 163

def setup_schedule(queue)
  # schedule hash must contain exactly one of the allowed keys
  msg_invalid_schedule = "Invalid config. schedule hash must contain " +
    "exactly one of the following keys - cron, at, every or in"
  raise Logstash::ConfigurationError, msg_invalid_schedule if @schedule.keys.length != 1
  schedule_type = @schedule.keys.first
  schedule_value = @schedule[schedule_type]
  raise LogStash::ConfigurationError, msg_invalid_schedule unless %w(cron every at in).include?(schedule_type)

  opts = schedule_type == "every" ? { first_in: 0.01 } : {}
  scheduler.public_send(schedule_type, schedule_value, opts) { run_once(queue) }
  scheduler.join
end

#stop ⇒ Object 



98
99
100
 
# File 'lib/logstash/inputs/akamai_siem.rb', line 98

def stop
  close_client
end