class LogStash::Filters::SNS

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/SNS.rb, line 22
def filter(event)
  #CPU
  if event.include?('CPU')
              values = event.get('CPU').split(',')
  event.remove('CPU')
              event.set('CPU_Userland', values[0].to_i)
              event.set('CPU_Kernel', values[1].to_i)
              event.set('CPU_Interrupt', values[2].to_i)
  end

  #PVM
  if event.include?('Pvm')
              values = event.get('Pvm').split(',')
  event.remove('Pvm')
              event.set('[Pvm][vuln_total]',    values[0].to_i)
              event.set('[Pvm][vuln_remote]',   values[1].to_i)
              event.set('[Pvm][vuln_server]',   values[2].to_i)
              event.set('[Pvm][vuln_crit]',     values[3].to_i)
              event.set('[Pvm][vuln_minor]',    values[4].to_i)
              event.set('[Pvm][vul_major]',     values[5].to_i)
              event.set('[Pvm][vuln_with_fix]', values[6].to_i)
              event.set('[Pvm][info_total]',    values[7].to_i)
              event.set('[Pvm][info_minor]',    values[8].to_i)
              event.set('[Pvm][info_major]',    values[9].to_i)
              event.set('[Pvm][info_host]',     values[10].to_i)
  end

  #aggXX, ethernetXX, ipsecXX, qidXX, sslvpnXX, vlanXX, wifiXX, wlanXX, wldevXX
  interfaces = event.to_hash.select { |key| key.to_s.match(/^(agg|ethernet|ipsec|qid|sslvpn|vlan|wifi|wlan|wldev)\d*$/i) }.keys
  interfaces.each do |iface|
    values = event.get(iface).split(',')
    event.remove(iface)
    event.set("[#{iface}][name]",          values[0])
    event.set("[#{iface}][ingress]",       values[1].to_i)
    event.set("[#{iface}][ingress_max]",   values[2].to_i)
    event.set("[#{iface}][egress]",        values[3].to_i)
    event.set("[#{iface}][egress_max]",    values[4].to_i)
    # For SNS > 3.x, interfaces have 7 values
    if values.size > 5
      event.set("[#{iface}][packet_accept]", values[5].to_i)
      event.set("[#{iface}][packet_block]",  values[6].to_i)
    end
  end

  # filter_matched should go in the last line of our successful code
  filter_matched(event)
end
register() click to toggle source
# File lib/logstash/filters/SNS.rb, line 17
def register
  # Add instance variables
end