class LogStash::Filters::Enrsig
This example filter will replace the contents of the default message field with whatever you specify in the configuration.
It is only intended to be used as an example.
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/enrsig.rb, line 39 def filter(event) return unless filter?(event) tnow = Time.now if @next_refresh < tnow if @load_statut == true @load_statut = false @logger.info("Configuration refresh...") load_conf @next_refresh = tnow + @refresh_interval @load_statut = true end end sleep(1) until @load_statut #verify if conf is not empty, if message contains ask if not @conf_enr.nil? and event.get(@field_enr).is_a?(Array) response=event.get(@field_enr).dup #verify if command exist in conf cnt_ea=0 for request_cmd in event.get(@field_enr) if request_cmd.is_a?(Hash) and not request_cmd.empty? #verify if command in request, exist in db if @conf_enr[request_cmd.keys[0]].is_a?(Hash) #verify if answer already present in db if not @cmd_db[request_cmd.keys[0]].is_a?(Hash) and @cmd_db[request_cmd.keys[0]][request_cmd[request_cmd.keys[0]]['name_in_db']].is_a?(Hash) #add info response[cnt_ea][request_cmd.keys[0]]['response']=@cmd_db[request_cmd.keys[0]][request_cmd[request_cmd.keys[0]]['name_in_db']] else #verify if field is present in event next if @conf_enr[request_cmd.keys[0]]['value_format'].length != request_cmd[request_cmd.keys[0]]['field'].length syntax_cmd=@conf_enr[request_cmd.keys[0]]['command_syntax'].dup #if field link not present, next! pnext=false cnt_e=1 for flval in request_cmd[request_cmd.keys[0]]['field'] if event.get(flval.to_s).nil? pnext=true break else #create syntaxe value_e=event.get(flval.to_s) pvf=cnt_e-1 #verify format (avoid vulnerability escape) || FILTER begin if value_e =~ /#{@conf_enr[request_cmd.keys[0]]['value_format'][pvf]}/i syntax_cmd.gsub! '$'+cnt_e.to_s+'$', value_e cnt_e+=1 else @logger.warn("Format of syntaxe command is bad with filter #{Regexp.escape(@conf_enr[request_cmd.keys[0]]['value_format'][pvf])}", :cmd => value_e) end rescue @logger.warn("Regexp error", :regexp => @conf_enr[request_cmd.keys[0]]['value_format'][pvf]) end end end next if pnext #verify if format valid is ok on all field next if cnt_e != request_cmd[request_cmd.keys[0]]['field'].length+1 or syntax_cmd =~ /\$\d+\$/ #run cmd output_cmd = `#{@conf_enr[request_cmd.keys[0]]['command_path']} #{syntax_cmd}` #transform "output_cmd" value to HASH with ERB begin result=ERB.new(@conf_enr[request_cmd.keys[0]]['template_erb']).result(binding) result=JSON.parse result.gsub('=>', ':') if result.is_a?(Hash) #insert in response response[cnt_ea][request_cmd.keys[0]]['response']=result #insert in db @cmd_db[request_cmd.keys[0]][request_cmd[request_cmd.keys[0]]['name_in_db']] = {} if @cmd_db[request_cmd.keys[0]][request_cmd[request_cmd.keys[0]]['name_in_db']].nil? @cmd_db[request_cmd.keys[0]][request_cmd[request_cmd.keys[0]]['name_in_db']]=result else @logger.warn("Command and ERB dont create HASH result!!", :result => result) end rescue @logger.warn("ERB/JSON parse error", :result => output_cmd) end end #finish (resend to origin) event.set(@field_enr,response) end end cnt_ea+=1 end end # filter_matched should go in the last line of our successful code filter_matched(event) end
register()
click to toggle source
# File lib/logstash/filters/enrsig.rb, line 27 def register @logger.info("Configuration Loading...") @cmd_db = {} @conf_enr = {} @hash_conf = "" load_conf @logger.info("finish") @next_refresh = Time.now + @refresh_interval @load_statut = true end
Private Instance Methods
load_conf()
click to toggle source
# File lib/logstash/filters/enrsig.rb, line 128 def load_conf if !File.exists?(@conf_enrsig) @logger.warn("DB file read failure, stop loading", :path => @conf_enrsig) exit -1 end tmp_hash = Digest::SHA256.hexdigest File.read @conf_enrsig if not tmp_hash == @hash_conf @hash_conf = tmp_hash begin tmp_enr = JSON.parse( IO.read(@conf_enrsig, encoding:'utf-8') ) #create db structure @conf_enr = tmp_enr @conf_enr.each do |k,v| @cmd_db[k]={} if @cmd_db[k].nil? if File.file?(@conf_enr[k]['result_parse'].to_s) @conf_enr[k]['template_erb']=File.read(@conf_enr[k]['result_parse'].to_s) else @logger.warn("Template parse for rules #{k.to_s} not find...", :path => @conf_enr[k]['result_parse']) @conf_enr[k]['template_erb']="" end end rescue @logger.error("JSON CONF ENR_SIG -- PARSE ERROR") end end end