class LogStash::Inputs::CiscoAMP

Public Instance Methods

register() click to toggle source
# File lib/logstash/inputs/logstash-input-cisco_amp.rb, line 21
def register
  @interval = @interval * 60
end
run(queue) click to toggle source
# File lib/logstash/inputs/logstash-input-cisco_amp.rb, line 25
def run(queue)
  while !stop?

    current_datetime = Time.now.utc - (@interval)
    iso8601date = current_datetime.iso8601
    events_uri = "https://api.amp.cisco.com/v1/events?start_date=" + iso8601date

    uri = URI.parse(events_uri)
    request = Net::HTTP::Get.new(uri)
    request.content_type = "application/json"
    request["Accept"] = "application/json"
    request.basic_auth @id,@key

    req_options = {
      use_ssl: uri.scheme == "https",
    }

    response = Net::HTTP.start(uri.hostname, uri.port, req_options) do |http|
      http.request(request)
    end

    data = JSON.parse(response.body)

    if data.has_key?("data")
      data['data'].each do |child|
        event = LogStash::Event.new("message" => child.to_json)
        decorate(event)
        queue << event
      end
    end

    Stud.stoppable_sleep(@interval) { stop? }
  end # loop
end
stop() click to toggle source
# File lib/logstash/inputs/logstash-input-cisco_amp.rb, line 60
def stop
end