class LogStash::Filters::CIDR
The CIDR
filter is for checking IP addresses in events against a list of network blocks that might contain it. Multiple addresses can be checked against multiple networks, any match succeeds. Upon success additional tags and/or fields can be added to the event.
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/cidr.rb, line 44 def filter(event) return unless filter?(event) address = @address.collect do |a| begin IPAddr.new(event.sprintf(a)) rescue ArgumentError => e @logger.warn("Invalid IP address, skipping", :address => a, :event => event) nil end end address.compact! network = @network.collect do |n| begin IPAddr.new(event.sprintf(n)) rescue ArgumentError => e @logger.warn("Invalid IP network, skipping", :network => n, :event => event) nil end end network.compact! # Try every combination of address and network, first match wins address.product(network).each do |a, n| @logger.debug("Checking IP inclusion", :address => a, :network => n) if n.include?(a) filter_matched(event) return end end end
register()
click to toggle source
# File lib/logstash/filters/cidr.rb, line 39 def register # Nothing end