class Fluent::AwsWafIPSetsOutput
Public Class Methods
new()
click to toggle source
Calls superclass method
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 14 def initialize super require 'aws-sdk' end
Public Instance Methods
configure(conf)
click to toggle source
Calls superclass method
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 19 def configure(conf) super @white_list = @white_list.split(',') log.info("white list => #{@white_list}") end
format(tag, time, record)
click to toggle source
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 44 def format(tag, time, record) [tag, time, record].to_msgpack end
shutdown()
click to toggle source
Calls superclass method
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 40 def shutdown super end
start()
click to toggle source
Calls superclass method
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 25 def start super options = {} options[:region] = @aws_region if @aws_region options[:access_key_id] = @aws_access_key_id if @aws_access_key_id options[:secret_access_key] = @aws_secret_access_key if @aws_secret_access_key @client = if @api_type == 'waf' Aws::WAF::Client.new(options) elsif @api_type == 'waf_regional' Aws::WAFRegional::Client.new(options) else raise Fluent::ConfigError, "unknown @api_type => [#{@api_type}]" end end
write(chunk)
click to toggle source
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 48 def write(chunk) counter = Hash.new{ |h,k| h[k] = 0 } chunk.msgpack_each do |(tag, time, record)| counter[record[ip_address_key]] += 1 end counter.each do |ip_address, count| if @dos_threshold < count update_ip_set(ip_address) end end end
Private Instance Methods
get_change_token()
click to toggle source
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 63 def get_change_token @client.get_change_token.change_token end
update_ip_set(ip_address)
click to toggle source
# File lib/fluent/plugin/out_aws_waf_ip_sets.rb, line 67 def update_ip_set(ip_address) if @white_list.include?(ip_address) log.info("white list ip_address => [#{ip_address}]") return end updates = [ { action: 'INSERT', ip_set_descriptor: { type: @ip_set_type, value: "#{ip_address}/32" } } ] begin resp = @client.update_ip_set({ change_token: get_change_token, ip_set_id: @ip_set_id, updates: updates }) log.info("INSERT block ip_address => [#{ip_address}]") rescue => e log.error("\n#{e.message}\n#{e.backtrace.join("\n")}") end end