logstash-filter-geoip 7.2.11-java → 7.2.13-java
Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: caca9f4a1ba058cc744e60279252429de5e33f041ecac3a2872b1973714961e2
|
|
4
|
+
data.tar.gz: 248298b87dc000636fe7775910cd1cf28eb18842200426b831c46a8c835d7db2
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: f2a9c1475b3832ef62a61998427fd0f8cac9aa18c28cba340cb0f9086ca298882dc99e1fcf9c0c6f08dc9dcf5eeb6543f4145d6536c74b85235a46c1bc4a1ff4
|
|
7
|
+
data.tar.gz: 10612c6801e46e32763c913ac55b9598959341b44f201a89cf1738ec2db84efdc3df3cf8edf1569d46dd5a5e06963023c1dc49f6e6127bb41aa2d25e655e8632
|
data/CHANGELOG.md
CHANGED
|
@@ -1,7 +1,13 @@
|
|
|
1
|
+
## 7.2.13
|
|
2
|
+
- [DOC] Add documentation for database auto-update configuration [#210](https://github.com/logstash-plugins/logstash-filter-geoip/pull/210)
|
|
3
|
+
|
|
4
|
+
## 7.2.12
|
|
5
|
+
- [DOC] Add `http_proxy` environment variable for GeoIP service endpoint. The feature is included in 8.1.0, and was back-ported to 7.17.2 [#207](https://github.com/logstash-plugins/logstash-filter-geoip/pull/207)
|
|
6
|
+
|
|
1
7
|
## 7.2.11
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
8
|
+
- Improved compatibility with the Elastic Common Schema [#206](https://github.com/logstash-plugins/logstash-filter-geoip/pull/206)
|
|
9
|
+
- Added support for ECS's composite `region_iso_code` (`US-WA`), which _replaces_ the non-ECS `region_code` (`WA`) as a default field with City databases. To get the stand-alone `region_code` in ECS mode, you must include it in the `fields` directive.
|
|
10
|
+
- [DOC] Improve ECS-related documentation
|
|
5
11
|
|
|
6
12
|
## 7.2.10
|
|
7
13
|
- [DOC] Air-gapped environment requires both ASN and City databases [#204](https://github.com/logstash-plugins/logstash-filter-geoip/pull/204)
|
data/docs/index.asciidoc
CHANGED
|
@@ -47,8 +47,8 @@ within 30 days of a database update.
|
|
|
47
47
|
|
|
48
48
|
The GeoIP filter plugin can manage the database for users running the Logstash default
|
|
49
49
|
distribution, or you can manage
|
|
50
|
-
database updates on your own. The behavior is controlled by the `database` setting.
|
|
51
|
-
When you use the default `database` setting
|
|
50
|
+
database updates on your own. The behavior is controlled by the `database` setting and by the auto-update feature.
|
|
51
|
+
When you use the default `database` setting and the auto-update feature is enabled, Logstash ensures that the plugin is
|
|
52
52
|
using the latest version of the database.
|
|
53
53
|
Otherwise, you are responsible for maintaining compliance.
|
|
54
54
|
|
|
@@ -59,27 +59,38 @@ database by default.
|
|
|
59
59
|
==== Database Auto-update
|
|
60
60
|
|
|
61
61
|
This plugin bundles Creative Commons (CC) license databases.
|
|
62
|
-
Logstash checks for database updates every day. It downloads the latest and can replace the old database
|
|
62
|
+
If the auto-update feature is enabled in `logstash.yml`(as it is by default), Logstash checks for database updates every day. It downloads the latest and can replace the old database
|
|
63
63
|
while the plugin is running.
|
|
64
|
-
After Logstash downloads EULA license databases, it will not fallback to CC license databases.
|
|
65
64
|
|
|
66
|
-
NOTE: If the database has never been updated successfully, as in air-gapped environments, Logstash can use CC license databases indefinitely.
|
|
65
|
+
NOTE: If the auto-update feature is disabled or the database has never been updated successfully, as in air-gapped environments, Logstash can use CC license databases indefinitely.
|
|
67
66
|
|
|
68
67
|
After Logstash has switched to a EULA licensed database, the geoip filter will
|
|
69
68
|
stop enriching events in order to maintain compliance if Logstash fails to
|
|
70
69
|
check for database updates for 30 days.
|
|
71
70
|
Events will be tagged with `_geoip_expired_database` tag to facilitate the handling of this situation.
|
|
72
71
|
|
|
72
|
+
NOTE: If the auto-update feature is enabled, Logstash upgrades from the CC database license to the EULA version on the first download.
|
|
73
|
+
|
|
73
74
|
TIP: When possible, allow Logstash to access the internet to download databases so that they are always up-to-date.
|
|
74
75
|
|
|
76
|
+
**Disable the auto-update feature**
|
|
77
|
+
|
|
78
|
+
If you work in air-gapped environment and want to disable the database auto-update feature, set the `xpack.geoip.downloader.enabled` value to `false` in `logstash.yml`.
|
|
79
|
+
|
|
80
|
+
When the auto-update feature is disabled, Logstash uses the Creative Commons (CC) license databases indefinitely, and any previously downloaded version of the EULA databases will be deleted.
|
|
81
|
+
|
|
75
82
|
[id="plugins-{type}s-{plugin}-manage_update"]
|
|
76
83
|
==== Manage your own database updates
|
|
77
84
|
|
|
78
|
-
**Use
|
|
85
|
+
**Use an HTTP proxy**
|
|
79
86
|
|
|
80
87
|
If you can't connect directly to the Elastic GeoIP endpoint, consider setting up
|
|
81
|
-
|
|
82
|
-
|
|
88
|
+
an HTTP proxy server. You can then specify the proxy with `http_proxy` environment variable.
|
|
89
|
+
|
|
90
|
+
[source,sh]
|
|
91
|
+
----
|
|
92
|
+
export http_proxy="http://PROXY_IP:PROXY_PORT"
|
|
93
|
+
----
|
|
83
94
|
|
|
84
95
|
**Use a custom endpoint (air-gapped environments)**
|
|
85
96
|
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
Gem::Specification.new do |s|
|
|
2
2
|
|
|
3
3
|
s.name = 'logstash-filter-geoip'
|
|
4
|
-
s.version = '7.2.
|
|
4
|
+
s.version = '7.2.13'
|
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
|
6
6
|
s.summary = "Adds geographical information about an IP address"
|
|
7
7
|
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
|
@@ -15,6 +15,8 @@ describe LogStash::Filters::GeoIP do
|
|
|
15
15
|
dir_path = Stud::Temporary.directory
|
|
16
16
|
File.open(dir_path + '/uuid', 'w') { |f| f.write(SecureRandom.uuid) }
|
|
17
17
|
allow(LogStash::SETTINGS).to receive(:get).and_call_original
|
|
18
|
+
allow(LogStash::SETTINGS).to receive(:get).with("xpack.geoip.downloader.enabled").and_return(true)
|
|
19
|
+
allow(LogStash::SETTINGS).to receive(:get).with("xpack.geoip.download.endpoint").and_return(nil)
|
|
18
20
|
allow(LogStash::SETTINGS).to receive(:get).with("path.data").and_return(dir_path)
|
|
19
21
|
end
|
|
20
22
|
|
|
Binary file
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: logstash-filter-geoip
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 7.2.
|
|
4
|
+
version: 7.2.13
|
|
5
5
|
platform: java
|
|
6
6
|
authors:
|
|
7
7
|
- Elastic
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2023-02-07 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
requirement: !ruby/object:Gem::Requirement
|