class LogStash::Filters::Accesswatch

The Access Watch filter adds information about robots visiting your website based on data from our robots database.

Public Instance Methods

augment(event, destination, data, keys=nil) click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 120
def augment(event, destination, data, keys=nil)
  if destination && data
    event.set(destination,
              data.select {|k, v|
                (keys.nil? or keys.include?(k)) && !(v.nil? || v.empty?)
              })
  end
end
fetch_address(ip) click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 100
def fetch_address(ip)
  self.with_cache("ip-#{ip}") {
    self.get_json("/1.1/address/#{ip}")
  }
end
fetch_identity(ip, user_agent) click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 112
def fetch_identity(ip, user_agent)
  ip = ip || ""
  user_agent = user_agent || ""
  self.with_cache("identity-#{Digest::MD5.hexdigest(ip)}-#{Digest::MD5.hexdigest(user_agent)}") {
    self.post_json("/1.1/identity", {:address => ip, :user_agent => user_agent})
  }
end
fetch_user_agent(user_agent) click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 106
def fetch_user_agent(user_agent)
  self.with_cache("ua-#{Digest::MD5.hexdigest(user_agent)}") {
    self.post_json("/1.1/user-agent", {:value => user_agent})
  }
end
filter(event) click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 130
def filter(event)
  begin
    ip = event.get(@ip_source)
    user_agent = event.get(@user_agent_source)
    if @ip_source and @user_agent_source
      data = self.fetch_identity(ip, user_agent)
      self.augment(event, @address_destination, data["address"], @@address_keys)
      self.augment(event, @robot_destination, data["robot"], @@robot_keys)
      self.augment(event, @reputation_destination, data["reputation"])
      self.augment(event, @identity_destination, data, @@identity_keys)
    elsif @ip_source
      data = self.fetch_address(ip)
      self.augment(event, @address_destination, data, @@address_keys)
    else
      data = self.fetch_user_agent(user_agent)
      self.augment(event, @user_agent_destination, data)
    end
  rescue => e
    @logger.error("Error augmenting the data.", error: e)
  end
  filter_matched(event)
end
get_json(path) click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 72
def get_json(path)
  self.submit {
    @client.get(self.url(path),
                headers: {"Api-Key"    => @api_key,
                          "Accept"     => "application/json",
                          "User-Agent" => "Access Watch Logstash Plugin/0.2.0"})
  }
end
post_json(path, data) click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 81
def post_json(path, data)
  self.submit {
    @client.post(self.url(path),
                 headers: {"Api-Key"      => @api_key,
                           "Accept"       => "application/json",
                           "Content-Type" => "application/json",
                           "User-Agent"   => "Access Watch Logstash Plugin/0.2.0"},
                 body: JSON.generate(data))
  }
end
register() click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 51
def register
  ca_file_path = File.expand_path '../../../cert.pem', File.dirname(__FILE__)
  @client = Manticore::Client.new request_timeout: @timeout, ssl: {:ca_file => ca_file_path}
  if @cache_size > 0
    @cache = LruRedux::ThreadSafeCache.new(@cache_size)
  end
end
submit(&block) click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 59
def submit(&block)
  http_response = block.call
  data = JSON.parse(http_response.body)
  if http_response.code != 200
    raise "Access Watch (#{data["code"]}): #{data["message"]}"
  end
  data
end
url(path) click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 68
def url(path)
  "https://api.access.watch#{path}"
end
with_cache(id, &block) click to toggle source
# File lib/logstash/filters/accesswatch.rb, line 92
def with_cache(id, &block)
  if @cache
    @cache.getset(id) { block.call }
  else
    block.call
  end
end