class LogStash::Filters::Ipam

This filter will replace the contents of the default message field with whatever you specify in the configuration.

It is only intended to be used as an .

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/ipam.rb, line 123
def filter(event)
  # Check file
  #   if doesn't exist => create with content.
  #   if need reset => update content.
  checkFile(event)

  # Get Subnets from updated file
  #   if can't read => Warning
  ipamSubnets = getIpamSubnets(event)

  # Get Subnets that contains IP
  #   if @gateway => Get 0.0.0.0 subnets
  #   else        => Don't get those subnets
  #   if !ipv4 => Don't handle those subnets
  subnets = checkIpSubnets(@ip, subnets)

  # Set field only if there is some subnets checked.
  if subnets.length > 0
    event.set(@field, subnets)
  else
    # filter_matched should go in the last line of our successful code
    filter_matched(event)
  end
end
register() click to toggle source
# File lib/logstash/filters/ipam.rb, line 37
def register
  # Check if the IP string is an actual IP, or stop process
  begin
    @ip = IPAddr.new(@ip)
  rescue ArgumentError => e
    @logger.warn("Invalid IP address, skipping", :address => @ip, :event => event)
    nil
  end
end

Private Instance Methods

checkFile(event) click to toggle source
# File lib/logstash/filters/ipam.rb, line 111
def checkFile(event)
  if (!File.exist?(@file) || File.mtime(@file).utc < (Time.now - @time_reset).utc)
    begin
      file = File.open(@file, 'w')
      file.write(downloadIpamSubnets(event))
    rescue
      @logger.warn("Impossible to write into file.", :address => @file, :event => event)
    end
  end
end
checkIpSubnets(ip, subnets) click to toggle source
# File lib/logstash/filters/ipam.rb, line 94
def checkIpSubnets(ip, subnets)
  results = Array.new
  subnets.each do |sub|
    if !sub['ipv4']
      next
    end
    if !@gateway && sub['subnet'] == "0.0.0.0"
      next
    end
    if IPAddr.new(sub['subnet'] + "/" + sub['netmask'].to_s).include?(ip)
      results.push(sub)
    end
  end
  return results
end
downloadIpamSubnets(event) click to toggle source
# File lib/logstash/filters/ipam.rb, line 48
def downloadIpamSubnets(event)
  begin
    # Create connection to the MySQL Database
    ActiveRecord::Base.establish_connection ({
        :adapter => "mysql",
        :host => @mysql_host,
        :username => @mysql_user,
        :password => @mysql_pass,
        :database => @mysql_db
    })

    # Get all the subnets from the Table
    subnets = ActiveRecord::Base.connection.exec_query("SELECT id, subnet, mask, description FROM subnets")

    # Set subnets into IPv4 address format
    subnets.each do |sub|
      isub = Integer(sub['subnet'])
      if isub >= 0 && isub <= 4294967295
        sub['subnet'] = IPAddr.new(isub, Socket::AF_INET).to_s
        sub['ipv4'] = true
      else
        sub['ipv4'] = false
        @logger.warn("Logger : Not compatible with IPv4.", :address => sub['subnet'], :event => event)
      end
    end

    # Parse result to create a JSON string
    return subnets.to_json
  rescue
      @logger.warn("Impossible to retrieve data from MySQL.", :address => @mysql_host, :event => event)
  end
  return json
end
getSubnets(event) click to toggle source
# File lib/logstash/filters/ipam.rb, line 83
def getSubnets(event)
  # Reading files
  begin
    file = File.read(@file)
    return  JSON.parse(file)
  rescue
    @logger.warn("Impossible to read into file.", :address => @file, :event => event)
  end
end