class LogStash::Filters::Ipam
This filter will replace the contents of the default message field with whatever you specify in the configuration.
It is only intended to be used as an .
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/ipam.rb, line 123 def filter(event) # Check file # if doesn't exist => create with content. # if need reset => update content. checkFile(event) # Get Subnets from updated file # if can't read => Warning ipamSubnets = getIpamSubnets(event) # Get Subnets that contains IP # if @gateway => Get 0.0.0.0 subnets # else => Don't get those subnets # if !ipv4 => Don't handle those subnets subnets = checkIpSubnets(@ip, subnets) # Set field only if there is some subnets checked. if subnets.length > 0 event.set(@field, subnets) else # filter_matched should go in the last line of our successful code filter_matched(event) end end
register()
click to toggle source
# File lib/logstash/filters/ipam.rb, line 37 def register # Check if the IP string is an actual IP, or stop process begin @ip = IPAddr.new(@ip) rescue ArgumentError => e @logger.warn("Invalid IP address, skipping", :address => @ip, :event => event) nil end end
Private Instance Methods
checkFile(event)
click to toggle source
# File lib/logstash/filters/ipam.rb, line 111 def checkFile(event) if (!File.exist?(@file) || File.mtime(@file).utc < (Time.now - @time_reset).utc) begin file = File.open(@file, 'w') file.write(downloadIpamSubnets(event)) rescue @logger.warn("Impossible to write into file.", :address => @file, :event => event) end end end
checkIpSubnets(ip, subnets)
click to toggle source
# File lib/logstash/filters/ipam.rb, line 94 def checkIpSubnets(ip, subnets) results = Array.new subnets.each do |sub| if !sub['ipv4'] next end if !@gateway && sub['subnet'] == "0.0.0.0" next end if IPAddr.new(sub['subnet'] + "/" + sub['netmask'].to_s).include?(ip) results.push(sub) end end return results end
downloadIpamSubnets(event)
click to toggle source
# File lib/logstash/filters/ipam.rb, line 48 def downloadIpamSubnets(event) begin # Create connection to the MySQL Database ActiveRecord::Base.establish_connection ({ :adapter => "mysql", :host => @mysql_host, :username => @mysql_user, :password => @mysql_pass, :database => @mysql_db }) # Get all the subnets from the Table subnets = ActiveRecord::Base.connection.exec_query("SELECT id, subnet, mask, description FROM subnets") # Set subnets into IPv4 address format subnets.each do |sub| isub = Integer(sub['subnet']) if isub >= 0 && isub <= 4294967295 sub['subnet'] = IPAddr.new(isub, Socket::AF_INET).to_s sub['ipv4'] = true else sub['ipv4'] = false @logger.warn("Logger : Not compatible with IPv4.", :address => sub['subnet'], :event => event) end end # Parse result to create a JSON string return subnets.to_json rescue @logger.warn("Impossible to retrieve data from MySQL.", :address => @mysql_host, :event => event) end return json end
getSubnets(event)
click to toggle source
# File lib/logstash/filters/ipam.rb, line 83 def getSubnets(event) # Reading files begin file = File.read(@file) return JSON.parse(file) rescue @logger.warn("Impossible to read into file.", :address => @file, :event => event) end end