class LogStash::Filters::Accesswatch
The Access Watch filter adds information about robots visiting your website based on data from our robots database.
Public Instance Methods
augment(event, destination, data, keys=nil)
click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 120 def augment(event, destination, data, keys=nil) if destination && data event.set(destination, data.select {|k, v| (keys.nil? or keys.include?(k)) && !(v.nil? || v.empty?) }) end end
fetch_address(ip)
click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 100 def fetch_address(ip) self.with_cache("ip-#{ip}") { self.get_json("/1.1/address/#{ip}") } end
fetch_identity(ip, user_agent)
click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 112 def fetch_identity(ip, user_agent) ip = ip || "" user_agent = user_agent || "" self.with_cache("identity-#{Digest::MD5.hexdigest(ip)}-#{Digest::MD5.hexdigest(user_agent)}") { self.post_json("/1.1/identity", {:address => ip, :user_agent => user_agent}) } end
fetch_user_agent(user_agent)
click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 106 def fetch_user_agent(user_agent) self.with_cache("ua-#{Digest::MD5.hexdigest(user_agent)}") { self.post_json("/1.1/user-agent", {:value => user_agent}) } end
filter(event)
click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 130 def filter(event) begin ip = event.get(@ip_source) user_agent = event.get(@user_agent_source) if @ip_source and @user_agent_source data = self.fetch_identity(ip, user_agent) self.augment(event, @address_destination, data["address"], @@address_keys) self.augment(event, @robot_destination, data["robot"], @@robot_keys) self.augment(event, @reputation_destination, data["reputation"]) self.augment(event, @identity_destination, data, @@identity_keys) elsif @ip_source data = self.fetch_address(ip) self.augment(event, @address_destination, data, @@address_keys) else data = self.fetch_user_agent(user_agent) self.augment(event, @user_agent_destination, data) end rescue => e @logger.error("Error augmenting the data.", error: e) end filter_matched(event) end
get_json(path)
click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 72 def get_json(path) self.submit { @client.get(self.url(path), headers: {"Api-Key" => @api_key, "Accept" => "application/json", "User-Agent" => "Access Watch Logstash Plugin/0.2.0"}) } end
post_json(path, data)
click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 81 def post_json(path, data) self.submit { @client.post(self.url(path), headers: {"Api-Key" => @api_key, "Accept" => "application/json", "Content-Type" => "application/json", "User-Agent" => "Access Watch Logstash Plugin/0.2.0"}, body: JSON.generate(data)) } end
register()
click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 51 def register ca_file_path = File.expand_path '../../../cert.pem', File.dirname(__FILE__) @client = Manticore::Client.new request_timeout: @timeout, ssl: {:ca_file => ca_file_path} if @cache_size > 0 @cache = LruRedux::ThreadSafeCache.new(@cache_size) end end
submit(&block)
click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 59 def submit(&block) http_response = block.call data = JSON.parse(http_response.body) if http_response.code != 200 raise "Access Watch (#{data["code"]}): #{data["message"]}" end data end
url(path)
click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 68 def url(path) "https://api.access.watch#{path}" end
with_cache(id, &block)
click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 92 def with_cache(id, &block) if @cache @cache.getset(id) { block.call } else block.call end end