class LogStash::Filters::Greynoise

This filter will replace the contents of the default message field with whatever you specify in the configuration.

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/greynoise.rb, line 98
def filter(event)
  valid = nil
  begin
    IPAddr.new(event.sprintf(ip))
  rescue ArgumentError => e
    valid = e
  end

  if valid
    @logger.error("Invalid IP address, skipping", :ip => event.sprintf(ip), :event => event.to_hash)
    event.tag(@tag_on_failure)
    return
  end

  if @hit_cache
    gn_result = @hit_cache[event.sprintf(ip)]

    # use cached data
    if gn_result
      event.set(@target, gn_result)
      filter_matched(event)
      return
    end
  end

  # use GN API, since not found in cache
  begin
    gn_result = lookup_ip(event.sprintf(ip), event.sprintf(key), @full_context)
    unless gn_result.nil?
      if @hit_cache
        # store in cache
        @hit_cache[event.sprintf(ip)] = gn_result
      end

      event.set(@target, gn_result)
      # filter_matched should go in the last line of our successful code
      filter_matched(event)
    end
  rescue InvalidAPIKey => _
    @logger.error("unauthorized - check API key")
    event.tag(@tag_on_auth_failure)
  end
end
register() click to toggle source
# File lib/logstash/filters/greynoise.rb, line 57
def register
  if @hit_cache_size > 0
    @hit_cache = LruRedux::TTL::ThreadSafeCache.new(@hit_cache_size, @hit_cache_ttl)
  end
end

Private Instance Methods

lookup_ip(target_ip, api_key, context = false) click to toggle source
# File lib/logstash/filters/greynoise.rb, line 66
def lookup_ip(target_ip, api_key, context = false)
  endpoint = "quick/"
  if context
    endpoint = "context/"
  end

  uri = URI.parse("https://api.greynoise.io/v2/noise/" + endpoint + target_ip)
  request = Net::HTTP::Get.new(uri)
  request["Key"] = api_key
  request["User-Agent"] = "logstash-filter-greynoise " + VERSION
  req_options = {
      use_ssl: uri.scheme == "https",
  }
  response = Net::HTTP.start(uri.hostname, uri.port, req_options) { |http|
    http.request(request)
  }

  if response.is_a?(Net::HTTPSuccess)
    result = JSON.parse(response.body)
    unless context
      result["seen"] = result.delete("noise")
    end
    result
  elsif response.is_a?(Net::HTTPUnauthorized)
    raise InvalidAPIKey.new
  else
    nil
  end
end