github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-04-24 06:37:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

- fix up documentation

Browse source 
- fix LOGSTASH-1013 (verify geoip tests fail before this commit, pass
  after)
- some style changes to make the code easier to read (less indentation)
This commit is contained in:
Jordan Sissel 2013-04-18 22:25:29 -07:00
parent 842e3ec182
commit c16d38f4c4
1 changed files with 28 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

52
lib/logstash/filters/geoip.rb
View file

@ -30,11 +30,14 @@ class LogStash::Filters::GeoIP < LogStash::Filters::Base
# array, only the first value will be used.
config :source, :validate => :string
# Array of fields that we want to be included in our event
# Default it will include all fields.
# Possible fields depend on the database type
# For the built in GeoLiteCity database:
# city_name, continent_code, country_code2, country_code3, country_name, dma_code, ip, latitude, longitude, postal_code, region_name, timezone
# Array of geoip fields that we want to be included in our event.
#
# Possible fields depend on the database type. By default, all geoip fields
# are included in the event.
#
# For the built in GeoLiteCity database, the following are available:
# city_name, continent_code, country_code2, country_code3, country_name,
# dma_code, ip, latitude, longitude, postal_code, region_name, timezone
config :fields, :validate => :array
public
@ -90,6 +93,7 @@ class LogStash::Filters::GeoIP < LogStash::Filters::Base
def filter(event)
return unless filter?(event)
geo_data = nil
begin
ip = event[@source]
ip = ip.first if ip.is_a? Array
@ -97,26 +101,26 @@ class LogStash::Filters::GeoIP < LogStash::Filters::Base
rescue SocketError => e
@logger.error("IP Field contained invalid IP address or hostname", :field => @field, :event => event)
rescue Exception => e
@logger.error("Uknown error while looking up GeoIP data", :exception => e, :field => @field, :event => event)
@logger.error("Unknown error while looking up GeoIP data", :exception => e, :field => @field, :event => event)
end
unless geo_data.nil?
geo_data_hash = geo_data.to_hash
geo_data_hash.delete(:request)
event["geoip"] = {} if event["geoip"].nil?
geo_data_hash.each do |key, value|
# Check if we have an array for specific fields
if !fields.empty?
# Check if the key is in our fields array
if fields.include?(key.to_s)
# convert key to string (normally a Symbol)
event["geoip"][key.to_s] = value
end
else
# convert key to string (normally a Symbol)
event["geoip"][key.to_s] = value
end
return if geo_data.nil?
geo_data_hash = geo_data.to_hash
geo_data_hash.delete(:request)
event["geoip"] = {} if event["geoip"].nil?
geo_data_hash.each do |key, value|
if @fields.nil? || @fields.empty?
# no fields requested, so add all geoip hash items to
# the event's fields.
# convert key to string (normally a Symbol)
event["geoip"][key.to_s] = value
elsif @fields.include?(key.to_s)
# Check if the key is in our fields array
# convert key to string (normally a Symbol)
event["geoip"][key.to_s] = value
end
filter_matched(event)
end
end # geo_data_hash.each
filter_matched(event)
end # def filter
end # class LogStash::Filters::GeoIP