fluent-plugin-geoip 0.4.0 → 0.5.0.beta
Sign up to get free protection for your applications and to get access to all the features.
- data/README.md +30 -11
- data/fluent-plugin-geoip.gemspec +6 -1
- data/lib/fluent/plugin/out_geoip.rb +2 -0
- data/test/plugin/test_out_geoip.rb +39 -1
- metadata +5 -5
data/README.md
CHANGED
@@ -16,9 +16,11 @@ before use, install dependent library as:
|
|
16
16
|
|
17
17
|
```bash
|
18
18
|
# for RHEL/CentOS
|
19
|
+
$ sudo yum group install "Development Tools"
|
19
20
|
$ sudo yum install geoip-devel --enablerepo=epel
|
20
21
|
|
21
22
|
# for Ubuntu/Debian
|
23
|
+
$ sudo apt-get install build-essential
|
22
24
|
$ sudo apt-get install libgeoip-dev
|
23
25
|
```
|
24
26
|
|
@@ -67,6 +69,9 @@ $ sudo td-agent-gem install fluent-plugin-geoip
|
|
67
69
|
remove_tag_prefix access.
|
68
70
|
tag geoip.${tag}
|
69
71
|
|
72
|
+
# To avoid get stacktrace error with `[null, null]` array for elasticsearch.
|
73
|
+
skip_adding_null_record true
|
74
|
+
|
70
75
|
# Set log_level for fluentd-v0.10.43 or earlier (default: warn)
|
71
76
|
log_level info
|
72
77
|
|
@@ -108,12 +113,15 @@ It is a sample to get friendly geo point recdords for elasticsearch with Yajl (J
|
|
108
113
|
# ex. "37.4192008972168,-122.05740356445312"
|
109
114
|
location_string ${latitude["host"]},${longitude["host"]}
|
110
115
|
|
111
|
-
# lat lon as array
|
116
|
+
# GeoJSON (lat lon as array) is useful for Kibana's bettermap.
|
112
117
|
# ex. [-122.05740356445312, 37.4192008972168]
|
113
118
|
location_array [${longitude["host"]},${latitude["host"]}]
|
114
119
|
</record>
|
115
120
|
remove_tag_prefix access.
|
116
121
|
tag geoip.${tag}
|
122
|
+
|
123
|
+
# To avoid get stacktrace error with `[null, null]` array for elasticsearch.
|
124
|
+
skip_adding_null_record true
|
117
125
|
</match>
|
118
126
|
```
|
119
127
|
|
@@ -130,6 +138,7 @@ On the case of using td-agent2 (v1-config), it have to quote `{ ... }` or `[ ...
|
|
130
138
|
</record>
|
131
139
|
remove_tag_prefix access.
|
132
140
|
tag geoip.${tag}
|
141
|
+
skip_adding_null_record true
|
133
142
|
</match>
|
134
143
|
```
|
135
144
|
|
@@ -182,17 +191,22 @@ http://dev.maxmind.com/geoip/legacy/csv/
|
|
182
191
|
|
183
192
|
## Placeholders
|
184
193
|
|
185
|
-
Provides these placeholders for adding field of geolocate results
|
194
|
+
Provides these placeholders for adding field of geolocate results.<br />
|
195
|
+
For more example of geolocating, you can try these websites like [Geo IP Address View](http://www.geoipview.com/) or [View my IP information](http://www.geoiptool.com/en/).
|
196
|
+
|
197
|
+
| placeholder attributes | output example | type | note |
|
198
|
+
|--------------------------------|-------------------|--------------|------|
|
199
|
+
| ${city[lookup_field]} | "Ithaca" | varchar(255) | - |
|
200
|
+
| ${latitude[lookup_field]} | 42.4277992248535 | decimal | - |
|
201
|
+
| ${longitude[lookup_field]} | -76.4981994628906 | decimal | - |
|
202
|
+
| ${country_code3[lookup_field]} | "USA" | varchar(3) | - |
|
203
|
+
| ${country_code[lookup_field]} | "US" | varchar(2) | A two-character ISO 3166-1 country code |
|
204
|
+
| ${country_name[lookup_field]} | "United States" | varchar(50) | - |
|
205
|
+
| ${dma_code[lookup_field]} | 555 | unsigned int | **only for US** |
|
206
|
+
| ${area_code[lookup_field]} | 607 | char(3) | **only for US** |
|
207
|
+
| ${region[lookup_field]} | "NY" | char(2) | A two character ISO-3166-2 or FIPS 10-4 code |
|
186
208
|
|
187
|
-
|
188
|
-
* ${latitude[lookup_field]}
|
189
|
-
* ${longitude[lookup_field]}
|
190
|
-
* ${country_code3[lookup_field]}
|
191
|
-
* ${country_code[lookup_field]}
|
192
|
-
* ${country_name[lookup_field]}
|
193
|
-
* ${dma_code[lookup_field]}
|
194
|
-
* ${area_code[lookup_field]}
|
195
|
-
* ${region[lookup_field]}
|
209
|
+
Further more specification available at http://dev.maxmind.com/geoip/legacy/csv/#GeoIP_City_Edition_CSV_Database_Fields
|
196
210
|
|
197
211
|
## Parameters
|
198
212
|
|
@@ -202,6 +216,11 @@ Provides these placeholders for adding field of geolocate results.
|
|
202
216
|
Add original tag name into filtered record using SetTagKeyMixin.<br />
|
203
217
|
Further details are written at http://docs.fluentd.org/articles/in_exec
|
204
218
|
|
219
|
+
* `skip_adding_null_record` (default: false)
|
220
|
+
|
221
|
+
Skip adding geoip fields when this valaues to `true`.
|
222
|
+
On the case of getting nothing of GeoIP info (such as local IP), it will output the original record without changing anything.
|
223
|
+
|
205
224
|
* `remove_tag_prefix`
|
206
225
|
* `remove_tag_suffix`
|
207
226
|
* `add_tag_prefix`
|
data/fluent-plugin-geoip.gemspec
CHANGED
@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
|
4
4
|
|
5
5
|
Gem::Specification.new do |spec|
|
6
6
|
spec.name = "fluent-plugin-geoip"
|
7
|
-
spec.version = "0.
|
7
|
+
spec.version = "0.5.0.beta"
|
8
8
|
spec.authors = ["Kentaro Yoshida"]
|
9
9
|
spec.email = ["y.ken.studio@gmail.com"]
|
10
10
|
spec.summary = %q{Fluentd Output plugin to add information about geographical location of IP addresses with Maxmind GeoIP databases.}
|
@@ -18,6 +18,11 @@ Gem::Specification.new do |spec|
|
|
18
18
|
|
19
19
|
spec.add_development_dependency "bundler"
|
20
20
|
spec.add_development_dependency "rake"
|
21
|
+
|
22
|
+
if defined?(RUBY_VERSION) && RUBY_VERSION > '2.2'
|
23
|
+
spec.add_development_dependency "test-unit", '~> 3'
|
24
|
+
end
|
25
|
+
|
21
26
|
spec.add_runtime_dependency "fluentd"
|
22
27
|
spec.add_runtime_dependency "fluent-mixin-rewrite-tag-name"
|
23
28
|
spec.add_runtime_dependency "geoip-c"
|
@@ -11,6 +11,7 @@ class Fluent::GeoipOutput < Fluent::BufferedOutput
|
|
11
11
|
config_param :geoip_database, :string, :default => File.dirname(__FILE__) + '/../../../data/GeoLiteCity.dat'
|
12
12
|
config_param :geoip_lookup_key, :string, :default => 'host'
|
13
13
|
config_param :tag, :string, :default => nil
|
14
|
+
config_param :skip_adding_null_record, :bool, :default => false
|
14
15
|
|
15
16
|
include Fluent::HandleTagNameMixin
|
16
17
|
include Fluent::SetTagKeyMixin
|
@@ -119,6 +120,7 @@ class Fluent::GeoipOutput < Fluent::BufferedOutput
|
|
119
120
|
|
120
121
|
def add_geoip_field(record)
|
121
122
|
placeholder = create_placeholder(geolocate(get_address(record)))
|
123
|
+
return record if @skip_adding_null_record && placeholder.values.first.nil?
|
122
124
|
@map.each do |record_key, value|
|
123
125
|
if value.match(REGEXP_PLACEHOLDER_SINGLE)
|
124
126
|
rewrited = placeholder[value]
|
@@ -162,7 +162,16 @@ class GeoipOutputTest < Test::Unit::TestCase
|
|
162
162
|
end
|
163
163
|
|
164
164
|
def test_emit_with_unknown_address
|
165
|
-
d1 = create_driver(
|
165
|
+
d1 = create_driver(%[
|
166
|
+
geoip_lookup_key host
|
167
|
+
<record>
|
168
|
+
geoip_city ${city['host']}
|
169
|
+
geopoint [${longitude['host']}, ${latitude['host']}]
|
170
|
+
</record>
|
171
|
+
skip_adding_null_record false
|
172
|
+
remove_tag_prefix input.
|
173
|
+
tag geoip.${tag}
|
174
|
+
], 'input.access')
|
166
175
|
d1.run do
|
167
176
|
# 203.0.113.1 is a test address described in RFC5737
|
168
177
|
d1.emit({'host' => '203.0.113.1', 'message' => 'invalid ip'})
|
@@ -176,6 +185,35 @@ class GeoipOutputTest < Test::Unit::TestCase
|
|
176
185
|
assert_equal nil, emits[1][2]['geoip_city']
|
177
186
|
end
|
178
187
|
|
188
|
+
def test_emit_with_skip_unknown_address
|
189
|
+
d1 = create_driver(%[
|
190
|
+
geoip_lookup_key host
|
191
|
+
<record>
|
192
|
+
geoip_city ${city['host']}
|
193
|
+
geopoint [${longitude['host']}, ${latitude['host']}]
|
194
|
+
</record>
|
195
|
+
skip_adding_null_record true
|
196
|
+
remove_tag_prefix input.
|
197
|
+
tag geoip.${tag}
|
198
|
+
], 'input.access')
|
199
|
+
d1.run do
|
200
|
+
# 203.0.113.1 is a test address described in RFC5737
|
201
|
+
d1.emit({'host' => '203.0.113.1', 'message' => 'invalid ip'})
|
202
|
+
d1.emit({'host' => '0', 'message' => 'invalid ip'})
|
203
|
+
d1.emit({'host' => '8.8.8.8', 'message' => 'google public dns'})
|
204
|
+
end
|
205
|
+
emits = d1.emits
|
206
|
+
assert_equal 3, emits.length
|
207
|
+
assert_equal 'geoip.access', emits[0][0] # tag
|
208
|
+
assert_equal nil, emits[0][2]['geoip_city']
|
209
|
+
assert_equal nil, emits[0][2]['geopoint']
|
210
|
+
assert_equal 'geoip.access', emits[1][0] # tag
|
211
|
+
assert_equal nil, emits[1][2]['geoip_city']
|
212
|
+
assert_equal nil, emits[1][2]['geopoint']
|
213
|
+
assert_equal 'Mountain View', emits[2][2]['geoip_city']
|
214
|
+
assert_equal [-122.08380126953125, 37.38600158691406], emits[2][2]['geopoint']
|
215
|
+
end
|
216
|
+
|
179
217
|
def test_emit_multiple_key
|
180
218
|
d1 = create_driver(%[
|
181
219
|
geoip_lookup_key from.ip, to.ip
|
metadata
CHANGED
@@ -1,15 +1,15 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: fluent-plugin-geoip
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.
|
5
|
-
prerelease:
|
4
|
+
version: 0.5.0.beta
|
5
|
+
prerelease: 6
|
6
6
|
platform: ruby
|
7
7
|
authors:
|
8
8
|
- Kentaro Yoshida
|
9
9
|
autorequire:
|
10
10
|
bindir: bin
|
11
11
|
cert_chain: []
|
12
|
-
date:
|
12
|
+
date: 2015-06-30 00:00:00.000000000 Z
|
13
13
|
dependencies:
|
14
14
|
- !ruby/object:Gem::Dependency
|
15
15
|
name: bundler
|
@@ -125,9 +125,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
125
125
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
126
126
|
none: false
|
127
127
|
requirements:
|
128
|
-
- - ! '
|
128
|
+
- - ! '>'
|
129
129
|
- !ruby/object:Gem::Version
|
130
|
-
version:
|
130
|
+
version: 1.3.1
|
131
131
|
requirements: []
|
132
132
|
rubyforge_project:
|
133
133
|
rubygems_version: 1.8.23
|