class LogStash::Filters::CIDR

The CIDR filter is for checking IP addresses in events against a list of network blocks that might contain it. Multiple addresses can be checked against multiple networks, any match succeeds. Upon success additional tags and/or fields can be added to the event.

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/cidr.rb, line 44
def filter(event)
  

  address = @address.collect do |a|
    begin
      IPAddr.new(event.sprintf(a))
    rescue ArgumentError => e
      @logger.warn("Invalid IP address, skipping", :address => a, :event => event)
      nil
    end
  end
  address.compact!

  network = @network.collect do |n|
    begin
      IPAddr.new(event.sprintf(n))
    rescue ArgumentError => e
      @logger.warn("Invalid IP network, skipping", :network => n, :event => event)
      nil
    end
  end
  network.compact!

  # Try every combination of address and network, first match wins
  address.product(network).each do |a, n|
    @logger.debug("Checking IP inclusion", :address => a, :network => n)
    if n.include?(a)
      filter_matched(event)
      return
    end
  end
end
register() click to toggle source
# File lib/logstash/filters/cidr.rb, line 39
def register
  # Nothing
end