iplookup

README

iplookup

This filter implements a generic ip lookup method using the package geoiplookup. All lookups are done using gRPC to another server (either locally or remote) that has implemented any geoiplookup server.

{
  "filter": [
    {
      "type": "iplookup",
      "server": "localhost:8081",
      "timeout": 2000,
      "ip_field": "message",
      "key": "iplocation",
      "skip_private": true,
      "private_net": [
        "172.16.0.0/12"
      ]
    }
  ]
}

Private nets are skipped by default, and all private IPv4 and IPv6 are included in the default list. Timeout is the time to wait for an answer in milliseconds, default is 2 sec.

Documentation

Index

• Constants
• func InitHandler(ctx context.Context, raw config.ConfigRaw, control config.Control) (config.TypeFilterConfig, error)
• type FilterConfig
  • func DefaultFilterConfig() FilterConfig
  • func (f *FilterConfig) Event(ctx context.Context, event logevent.LogEvent) (logevent.LogEvent, bool)

Constants

const ErrorTag = "iplookup_error"

ErrorTag tag added to event when process module failed

const ModuleName = "iplookup"

ModuleName is the name used in config file

Functions

func InitHandler

func InitHandler(ctx context.Context, raw config.ConfigRaw, control config.Control) (config.TypeFilterConfig, error)

InitHandler initialize the filter plugin

Types

type FilterConfig

type FilterConfig struct {
	config.FilterConfig
	Server      string   `json:"server" yaml:"server"`             // server to connect to
	Timeout     uint     `json:"timeout" yaml:"timeout"`           // timeout in milliseconds
	Key         string   `json:"key" yaml:"key"`                   // field to save the result to
	IPField     string   `json:"ip_field" yaml:"ip_field"`         // IP field to get ip address from
	SkipPrivate bool     `json:"skip_private" yaml:"skip_private"` // skip private IP addresses
	PrivateNet  []string `json:"private_net" yaml:"private_net"`   // list of own defined private IP addresses
	// contains filtered or unexported fields
}

FilterConfig holds the configuration json fields and internal objects

func DefaultFilterConfig

func DefaultFilterConfig() FilterConfig

DefaultFilterConfig returns an FilterConfig struct with default values

func (*FilterConfig) Event

func (f *FilterConfig) Event(ctx context.Context, event logevent.LogEvent) (logevent.LogEvent, bool)

Event the main filter event