filtergeoip2

README

gogstash geoip2 filter module

You need to download geoip2 database manually and setup file path in config.

• http://dev.maxmind.com/geoip/geoip2/downloadable/
• http://dev.maxmind.com/geoip/geoip2/geolite2/

The database is automatically reloaded on changes.

Synopsis

filter:
  - type: geoip2
    # (required) geoip2 database file path, default: GeoLite2-City.mmdb
    db_path: "geoip2/database/file/path/GeoLite2-City.mmdb"

    # (required) ip address field to parse
    ip_field: remote_addr

    # (optional) does not try to process private IP networks as they will fail, default: false
    skip_private: true

    # (optional) lets you specify your own definition for private IP addresses, both IPv4 and IPv6, default is private IP addresses
    private_net:
      - 10.0.0.0/8
      - 192.168.0.0/16

    # (optional) size of cache entries on IP addresses, so lookups don't go through the database, default is 100000
    cache_size: 100000

    # (optional) parsed geoip info should saved to field, default: geoip
    key: geoip

    # (optional) parsed geoip info into flat format, default: false
    # `city_name`, `continent_code`, `country_code`, `country_name`,
    # `ip`, `latitude`, `longitude`, `postal_code`, `region_code`, `region_name` and `timezone`.
    flat_format: false

    # (optional) if true does not log lookup failures from the database, default is false
    quiet: true

Documentation

Index

• Constants
• func InitHandler(ctx context.Context, raw config.ConfigRaw, control config.Control) (config.TypeFilterConfig, error)
• type FilterConfig
  • func DefaultFilterConfig() FilterConfig
  • func (f *FilterConfig) Event(ctx context.Context, event logevent.LogEvent) (logevent.LogEvent, bool)

Constants

const ErrorTag = "gogstash_filter_geoip2_error"

ErrorTag tag added to event when process geoip2 failed

const ModuleName = "geoip2"

ModuleName is the name used in config file

Functions

func InitHandler

func InitHandler(
	ctx context.Context,
	raw config.ConfigRaw,
	control config.Control,
) (config.TypeFilterConfig, error)

InitHandler initialize the filter plugin

Types

type FilterConfig

type FilterConfig struct {
	config.FilterConfig

	DBPath      string   `json:"db_path" yaml:"db_path"`           // geoip2 db file path, default: GeoLite2-City.mmdb
	IPField     string   `json:"ip_field" yaml:"ip_field"`         // IP field to get geoip info
	Key         string   `json:"key" yaml:"key"`                   // geoip destination field name, default: geoip
	QuietFail   bool     `json:"quiet" yaml:"quiet"`               // fail quietly
	SkipPrivate bool     `json:"skip_private" yaml:"skip_private"` // skip private IP addresses
	PrivateNet  []string `json:"private_net" yaml:"private_net"`   // list of own defined private IP addresses
	FlatFormat  bool     `json:"flat_format" yaml:"flat_format"`   // flat format
	CacheSize   int      `json:"cache_size" yaml:"cache_size"`     // cache size
	// contains filtered or unexported fields
}

FilterConfig holds the configuration json fields and internal objects

func DefaultFilterConfig

func DefaultFilterConfig() FilterConfig

DefaultFilterConfig returns an FilterConfig struct with default values

func (*FilterConfig) Event

func (f *FilterConfig) Event(ctx context.Context, event logevent.LogEvent) (logevent.LogEvent, bool)

Event the main filter event