logstash-filter-geoip 4.0.4-java → 4.1.1-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: bbf7e3621c24e4bc6f64df90421f55c52f74c13e
-  data.tar.gz: 03641338d9d39484912b82551cc33dc97a61d2f2
+  metadata.gz: c9e2ae6154f3fb6786003715d49ffb91f35a2e34
+  data.tar.gz: 50c92eba1af277a4ddce9f038142a035063b0b07
 SHA512:
-  metadata.gz: 14e164de08ebb4410115223a3ad18a67aa50d3b86162f9f1b981657f63ea3d828b436036b2498f2e5ee47ed781ea34ff68f7e1a11e132c457bef5688b7e45e54
-  data.tar.gz: 101805ecd116cccea5dfcd48de645d6f86d47cc2aba7c9cf5466eecfb39f815dbe2c0a472a2da6cb01e2e0e72375cf33b05ae86459a5104758d4790951644541
+  metadata.gz: 731ce064ee7eae5cb286d12d7736c162016b5fe68c1e6c48697f1ffc930893f9a941cdcd4ecc715fed6077d82ace86c1d8c8446447c7599e8e16a83e55916b32
+  data.tar.gz: a374eeef224c9e60a13d4aac58a89c19d4c47c51fafb60915e8bedcd487221802ddc0c6ec63576e3ed4cf053f390a5b761fd8801d55e1b7b2c7a057fdaae6db1

data/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 4.1.1
+  - Add support for commercial databases from Maxmind.
+  - Add ASN data support via GeoIP2-ISP database.
+  
+## 4.1.0
+  - Removed from RubyGems.org since it was missing the default GeoIP2 database.  
+
+## 4.0.6
+  - Docs: Remove patch classes from the main plugin file
+  - Update of the GeoIP2 DB
+
+## 4.0.5
+  - Docs: Clarify GeoLite2 database support
+  
 ## 4.0.4
   - Update of the GeoIP2 DB
   - Target should be merged and not completely overwritten (#98)

data/docs/index.asciidoc

@@ -0,0 +1,180 @@
+:plugin: geoip
+:type: filter
+
+///////////////////////////////////////////
+START - GENERATED VARIABLES, DO NOT EDIT!
+///////////////////////////////////////////
+:version: %VERSION%
+:release_date: %RELEASE_DATE%
+:changelog_url: %CHANGELOG_URL%
+:include_path: ../../../logstash/docs/include
+///////////////////////////////////////////
+END - GENERATED VARIABLES, DO NOT EDIT!
+///////////////////////////////////////////
+
+[id="plugins-{type}-{plugin}"]
+
+=== Geoip
+
+include::{include_path}/plugin_header.asciidoc[]
+
+==== Description
+
+The GeoIP filter adds information about the geographical location of IP addresses,
+based on data from the Maxmind GeoLite2 database. Commercial databases from Maxmind are 
+also supported in this plugin.
+
+A `[geoip][location]` field is created if
+the GeoIP lookup returns a latitude and longitude. The field is stored in
+http://geojson.org/geojson-spec.html[GeoJSON] format. Additionally,
+the default Elasticsearch template provided with the
+<<plugins-outputs-elasticsearch,`elasticsearch` output>> maps
+the `[geoip][location]` field to an http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/mapping-geo-point-type.html#_mapping_options[Elasticsearch geo_point].
+
+As this field is a `geo_point` _and_ it is still valid GeoJSON, you get
+the awesomeness of Elasticsearch's geospatial query, facet and filter functions
+and the flexibility of having GeoJSON for all other applications (like Kibana's
+map visualization).
+
+[NOTE]
+--
+This product includes GeoLite2 data created by MaxMind, available from
+http://www.maxmind.com. This database is licensed under
+http://creativecommons.org/licenses/by-sa/4.0/[Creative Commons Attribution-ShareAlike 4.0 International License].
+
+Versions 4.0.0 and later of the GeoIP filter use the MaxMind GeoLite2 database
+and support both IPv4 and IPv6 lookups. Versions prior to 4.0.0 use the legacy
+MaxMind GeoLite database and support IPv4 lookups only.
+--
+
+[id="plugins-{type}s-{plugin}-options"]
+==== Geoip Filter Configuration Options
+
+This plugin supports the following configuration options plus the <<plugins-{type}s-common-options>> described later.
+
+[cols="<,<,<",options="header",]
+|=======================================================================
+|Setting |Input type|Required
+| <<plugins-{type}s-{plugin}-cache_size>> |<<number,number>>|No
+| <<plugins-{type}s-{plugin}-database>> |a valid filesystem path|No
+| <<plugins-{type}s-{plugin}-fields>> |<<array,array>>|No
+| <<plugins-{type}s-{plugin}-source>> |<<string,string>>|Yes
+| <<plugins-{type}s-{plugin}-tag_on_failure>> |<<array,array>>|No
+| <<plugins-{type}s-{plugin}-target>> |<<string,string>>|No
+|=======================================================================
+
+Also see <<plugins-{type}s-common-options>> for a list of options supported by all
+filter plugins.
+
+&nbsp;
+
+[id="plugins-{type}s-{plugin}-cache_size"]
+===== `cache_size` 
+
+  * Value type is <<number,number>>
+  * Default value is `1000`
+
+GeoIP lookup is surprisingly expensive. This filter uses an cache to take advantage of the fact that
+IPs agents are often found adjacent to one another in log files and rarely have a random distribution.
+The higher you set this the more likely an item is to be in the cache and the faster this filter will run.
+However, if you set this too high you can use more memory than desired.
+Since the Geoip API upgraded to v2, there is not any eviction policy so far, if cache is full, no more record can be added.
+Experiment with different values for this option to find the best performance for your dataset.
+
+This MUST be set to a value > 0. There is really no reason to not want this behavior, the overhead is minimal
+and the speed gains are large.
+
+It is important to note that this config value is global to the geoip_type. That is to say all instances of the geoip filter
+of the same geoip_type share the same cache. The last declared cache size will 'win'. The reason for this is that there would be no benefit
+to having multiple caches for different instances at different points in the pipeline, that would just increase the
+number of cache misses and waste memory.
+
+[id="plugins-{type}s-{plugin}-database"]
+===== `database` 
+
+  * Value type is <<path,path>>
+  * There is no default value for this setting.
+
+The path to Maxmind's database file that Logstash should use. The default database is GeoLite2-City.
+GeoLite2-City, GeoLite2-Country, GeoLite2-ASN are the free databases from Maxmind that are supported.
+GeoIP2-City, GeoIP2-ISP, GeoIP2-Country are the commercial databases from Maxmind that are supported.
+
+If not specified, this will default to the GeoLite2 City database that ships
+with Logstash.
+
+[id="plugins-{type}s-{plugin}-fields"]
+===== `fields` 
+
+  * Value type is <<array,array>>
+  * There is no default value for this setting.
+
+An array of geoip fields to be included in the event.
+
+Possible fields depend on the database type. By default, all geoip fields
+are included in the event.
+
+For the built-in GeoLite2 City database, the following are available:
+`city_name`, `continent_code`, `country_code2`, `country_code3`, `country_name`,
+`dma_code`, `ip`, `latitude`, `longitude`, `postal_code`, `region_name` and `timezone`.
+
+[id="plugins-{type}s-{plugin}-lru_cache_size"]
+===== `lru_cache_size`  (DEPRECATED)
+
+  * DEPRECATED WARNING: This configuration item is deprecated and may not be available in future versions.
+  * Value type is <<number,number>>
+  * Default value is `1000`
+
+GeoIP lookup is surprisingly expensive. This filter uses an LRU cache to take advantage of the fact that
+IPs agents are often found adjacent to one another in log files and rarely have a random distribution.
+The higher you set this the more likely an item is to be in the cache and the faster this filter will run.
+However, if you set this too high you can use more memory than desired.
+
+Experiment with different values for this option to find the best performance for your dataset.
+
+This MUST be set to a value > 0. There is really no reason to not want this behavior, the overhead is minimal
+and the speed gains are large.
+
+It is important to note that this config value is global to the geoip_type. That is to say all instances of the geoip filter
+of the same geoip_type share the same cache. The last declared cache size will 'win'. The reason for this is that there would be no benefit
+to having multiple caches for different instances at different points in the pipeline, that would just increase the
+number of cache misses and waste memory.
+
+[id="plugins-{type}s-{plugin}-source"]
+===== `source` 
+
+  * This is a required setting.
+  * Value type is <<string,string>>
+  * There is no default value for this setting.
+
+The field containing the IP address or hostname to map via geoip. If
+this field is an array, only the first value will be used.
+
+[id="plugins-{type}s-{plugin}-tag_on_failure"]
+===== `tag_on_failure` 
+
+  * Value type is <<array,array>>
+  * Default value is `["_geoip_lookup_failure"]`
+
+Tags the event on failure to look up geo information. This can be used in later analysis.
+
+[id="plugins-{type}s-{plugin}-target"]
+===== `target` 
+
+  * Value type is <<string,string>>
+  * Default value is `"geoip"`
+
+Specify the field into which Logstash should store the geoip data.
+This can be useful, for example, if you have `src_ip` and `dst_ip` fields and
+would like the GeoIP information of both IPs.
+
+If you save the data to a target field other than `geoip` and want to use the
+`geo_point` related functions in Elasticsearch, you need to alter the template
+provided with the Elasticsearch output and configure the output to use the
+new template.
+
+Even if you don't use the `geo_point` mapping, the `[target][location]` field
+is still valid GeoJSON.
+
+
+
+include::{include_path}/{type}.asciidoc[]

data/lib/logstash-filter-geoip_jars.rb

@@ -1,5 +1,6 @@
-# encoding: utf-8
-require 'logstash/environment'
+# AUTOGENERATED BY THE GRADLE SCRIPT. DO NOT EDIT.
 
-root_dir = File.expand_path(File.join(File.dirname(__FILE__), ".."))
-LogStash::Environment.load_runtime_jars! File.join(root_dir, "vendor")
+require 'jar_dependencies'
+require_jar('com.maxmind.geoip2', 'geoip2', '2.8.0')
+require_jar('com.maxmind.db', 'maxmind-db', '1.2.1')
+require_jar('org.logstash.filters', 'logstash-filter-geoip', '4.1.0')

data/lib/logstash/filters/geoip.rb

@@ -4,33 +4,6 @@ require "logstash/namespace"
 
 require "logstash-filter-geoip_jars"
 
-java_import "java.net.InetAddress"
-java_import "com.maxmind.geoip2.DatabaseReader"
-java_import "com.maxmind.geoip2.model.CityResponse"
-java_import "com.maxmind.geoip2.record.Country"
-java_import "com.maxmind.geoip2.record.Subdivision"
-java_import "com.maxmind.geoip2.record.City"
-java_import "com.maxmind.geoip2.record.Postal"
-java_import "com.maxmind.geoip2.record.Location"
-java_import "com.maxmind.db.CHMCache"
-
-def suppress_all_warnings
-  old_verbose = $VERBOSE
-  begin
-    $VERBOSE = nil
-    yield if block_given?
-  ensure
-    # always re-set to old value, even if block raises an exception
-    $VERBOSE = old_verbose
-  end
-end
-
-# create a new instance of the Java class File without shadowing the Ruby version of the File class
-module JavaIO
-  include_package "java.io"
-end
-
-
 # The GeoIP filter adds information about the geographical location of IP addresses,
 # based on data from the Maxmind GeoLite2 database.
 #
@@ -46,9 +19,16 @@ end
 # and the flexibility of having GeoJSON for all other applications (like Kibana's
 # map visualization).
 #
-# Note: This product includes GeoLite2 data created by MaxMind, available from
+# [NOTE]
+# --
+# This product includes GeoLite2 data created by MaxMind, available from
 # http://www.maxmind.com. This database is licensed under
-# http://creativecommons.org/licenses/by-sa/4.0/[Creative Commons Attribution-ShareAlike 4.0 International License]
+# http://creativecommons.org/licenses/by-sa/4.0/[Creative Commons Attribution-ShareAlike 4.0 International License].
+#
+# Versions 4.0.0 and later of the GeoIP filter use the MaxMind GeoLite2 database
+# and support both IPv4 and IPv6 lookups. Versions prior to 4.0.0 use the legacy
+# MaxMind GeoLite database and support IPv4 lookups only.
+# --
 
 class LogStash::Filters::GeoIP < LogStash::Filters::Base
   config_name "geoip"
@@ -71,11 +51,7 @@ class LogStash::Filters::GeoIP < LogStash::Filters::Base
   # For the built-in GeoLite2 City database, the following are available:
   # `city_name`, `continent_code`, `country_code2`, `country_code3`, `country_name`,
   # `dma_code`, `ip`, `latitude`, `longitude`, `postal_code`, `region_name` and `timezone`.
-  config :fields, :validate => :array, :default => ['city_name', 'continent_code',
-                                                    'country_code2', 'country_code3', 'country_name',
-                                                    'dma_code', 'ip', 'latitude',
-                                                    'longitude', 'postal_code', 'region_name',
-                                                    'region_code', 'timezone', 'location']
+  config :fields, :validate => :array
 
   # Specify the field into which Logstash should store the geoip data.
   # This can be useful, for example, if you have `src_ip` and `dst_ip` fields and
@@ -120,111 +96,34 @@ class LogStash::Filters::GeoIP < LogStash::Filters::Base
   # of the same geoip_type share the same cache. The last declared cache size will 'win'. The reason for this is that there would be no benefit
   # to having multiple caches for different instances at different points in the pipeline, that would just increase the
   # number of cache misses and waste memory.
-  config :lru_cache_size, :validate => :number, :default => 1000
+  config :lru_cache_size, :validate => :number, :default => 1000, :deprecated => "This field has been deprecated in favor of cache_size."
 
   # Tags the event on failure to look up geo information. This can be used in later analysis.
   config :tag_on_failure, :validate => :array, :default => ["_geoip_lookup_failure"]
 
   public
   def register
-    suppress_all_warnings do
-      if @database.nil?
-        @database = ::Dir.glob(::File.join(::File.expand_path("../../../vendor/", ::File.dirname(__FILE__)),"GeoLite2-City.mmdb")).first
+    if @database.nil?
+      @database = ::Dir.glob(::File.join(::File.expand_path("../../../vendor/", ::File.dirname(__FILE__)),"GeoLite2-City.mmdb")).first
 
-        if @database.nil? || !File.exists?(@database)
-          raise "You must specify 'database => ...' in your geoip filter (I looked for '#{@database}')"
-        end
-      end
-
-      @logger.info("Using geoip database", :path => @database)
-
-      db_file = JavaIO::File.new(@database)
-      begin
-        @parser = DatabaseReader::Builder.new(db_file).withCache(CHMCache.new(@cache_size)).build();
-      rescue Java::ComMaxmindDb::InvalidDatabaseException => e
-        @logger.error("The GeoLite2 MMDB database provided is invalid or corrupted.", :exception => e, :field => @source)
-        raise e
+      if @database.nil? || !File.exists?(@database)
+        raise "You must specify 'database => ...' in your geoip filter (I looked for '#{@database}')"
       end
     end
+
+    @logger.info("Using geoip database", :path => @database)
+    
+    @geoipfilter = org.logstash.filters.GeoIPFilter.new(@source, @target, @fields, @database, @cache_size)
   end # def register
 
   public
   def filter(event)
     return unless filter?(event)
-
-    begin
-      ip = event.get(@source)
-      ip = ip.first if ip.is_a? Array
-      geo_data_hash = Hash.new
-      ip_address = InetAddress.getByName(ip)
-      response = @parser.city(ip_address)
-      populate_geo_data(response, ip_address, geo_data_hash)
-    rescue com.maxmind.geoip2.exception.AddressNotFoundException => e
-      @logger.debug("IP not found!", :exception => e, :field => @source, :event => event)
-    rescue java.net.UnknownHostException => e
-      @logger.error("IP Field contained invalid IP address or hostname", :exception => e, :field => @source, :event => event)
-    rescue Exception => e
-      @logger.error("Unknown error while looking up GeoIP data", :exception => e, :field => @source, :event => event)
-      # Dont' swallow this, bubble up for unknown issue
-      raise e
-    end
-
-    if apply_geodata(geo_data_hash, event)
+    if @geoipfilter.handleEvent(event)
       filter_matched(event)
     else
       tag_unsuccessful_lookup(event)
     end
-  end # def filter
-
-  def populate_geo_data(response, ip_address, geo_data_hash)
-    country = response.getCountry()
-    subdivision = response.getMostSpecificSubdivision()
-    city = response.getCity()
-    postal = response.getPostal()
-    location = response.getLocation()
-
-    # if location is empty, there is no point populating geo data
-    # and most likely all other fields are empty as well
-    if location.getLatitude().nil? && location.getLongitude().nil?
-      return
-    end
-
-    @fields.each do |field|
-      case field
-      when "city_name"
-        geo_data_hash["city_name"] = city.getName()
-      when "country_name"
-        geo_data_hash["country_name"] = country.getName()
-      when "continent_code"
-        geo_data_hash["continent_code"] = response.getContinent().getCode()
-      when "continent_name"
-        geo_data_hash["continent_name"] = response.getContinent().getName()
-      when "country_code2"
-        geo_data_hash["country_code2"] = country.getIsoCode()
-      when "country_code3"
-        geo_data_hash["country_code3"] = country.getIsoCode()
-      when "ip"
-        geo_data_hash["ip"] = ip_address.getHostAddress()
-      when "postal_code"
-        geo_data_hash["postal_code"] = postal.getCode()
-      when "dma_code"
-        geo_data_hash["dma_code"] = location.getMetroCode()
-      when "region_name"
-        geo_data_hash["region_name"] = subdivision.getName()
-      when "region_code"
-        geo_data_hash["region_code"] = subdivision.getIsoCode()
-      when "timezone"
-        geo_data_hash["timezone"] = location.getTimeZone()
-      when "location"
-        geo_data_hash["location"] = [ location.getLongitude(), location.getLatitude() ]
-      when "latitude"
-        geo_data_hash["latitude"] = location.getLatitude()
-      when "longitude"
-        geo_data_hash["longitude"] = location.getLongitude()
-      else
-        raise Exception.new("[#{field}] is not a supported field option.")
-      end
-    end
   end
 
   def tag_unsuccessful_lookup(event)
@@ -232,20 +131,4 @@ class LogStash::Filters::GeoIP < LogStash::Filters::Base
     @tag_on_failure.each{|tag| event.tag(tag)}
   end
 
-  def apply_geodata(geo_data_hash, event)
-    # don't do anything more if the lookup result is nil?
-    return false if geo_data_hash.nil?
-    # only do event.set(@target) if the lookup result is not nil
-    event.set(@target, {}) if event.get(@target).nil?
-    # don't do anything more if the lookup result is empty?
-    return false if geo_data_hash.empty?
-    geo_data_hash.each do |key, value|
-      if @fields.include?(key) && value
-        # can't dup numerics
-        event.set("[#{@target}][#{key}]", value.is_a?(Numeric) ? value : value.dup)
-      end
-    end # geo_data_hash.each
-    true
-  end
-
 end # class LogStash::Filters::GeoIP

data/lib/logstash/filters/geoip/patch.rb

@@ -0,0 +1,17 @@
+# encoding: utf-8
+def suppress_all_warnings
+  old_verbose = $VERBOSE
+  begin
+    $VERBOSE = nil
+    yield if block_given?
+  ensure
+    # always re-set to old value, even if block raises an exception
+    $VERBOSE = old_verbose
+  end
+end
+
+# create a new instance of the Java class File without shadowing the Ruby version of the File class
+module JavaIO
+  include_package "java.io"
+end
+

data/logstash-filter-geoip.gemspec

@@ -1,18 +1,18 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-geoip'
-  s.version         = '4.0.4'
+  s.version         = '4.1.1'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "$summary"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
   s.authors         = ["Elastic"]
   s.email           = 'info@elastic.co'
   s.homepage        = "http://www.elastic.co/guide/en/logstash/current/index.html"
-  s.require_paths = ["lib"]
   s.platform      = "java"
+  s.require_paths = ["lib", "vendor/jar-dependencies"]
 
   # Files
-  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT', 'maxmind-db-NOTICE.txt']
+  s.files = Dir['lib/**/*','spec/**/*','vendor/**/*', 'vendor/jar-dependencies/**/*.jar', '*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT', 'maxmind-db-NOTICE.txt', 'docs/**/*']
 
   # Tests
   s.test_files = s.files.grep(%r{^(test|spec|features)/})
@@ -22,12 +22,6 @@ Gem::Specification.new do |s|
 
   # Gem dependencies
   s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
-
-  s.requirements << "jar com.maxmind.geoip2:geoip2, 2.5.0, :exclusions=> [com.google.http-client:google-http-client]"
-
-  s.add_development_dependency "jar-dependencies"
-
-  s.add_development_dependency 'ruby-maven', '~> 3.3'
-
   s.add_development_dependency 'logstash-devutils'
+  s.add_development_dependency 'benchmark-ips'
 end

data/spec/filters/geoip_spec.rb

@@ -97,7 +97,7 @@ describe LogStash::Filters::GeoIP do
 
       it "should set other subfields of 'target' properly" do
         expect(event.get("target").to_hash.keys.sort).to eq(["city_name", "ip", "region_name"])
-        expect(event.get("[target][city_name]")).to eq("Mendon")
+        expect(event.get("[target][city_name]")).to eq("Worcester")
         expect(event.get("[target][region_name]")).to eq("Massachusetts")
       end
 
@@ -251,13 +251,6 @@ describe LogStash::Filters::GeoIP do
 
     end
 
-    context "should return the correct source field in the logging message" do
-      sample("ip" => "-") do
-        expect(LogStash::Filters::GeoIP.logger).to receive(:error).with(anything, include(:field => "ip"))
-        subject
-      end
-    end
-
   end
 
   describe "an invalid database" do
@@ -272,8 +265,7 @@ describe LogStash::Filters::GeoIP do
 
     context "should return the correct sourcefield in the logging message" do
       sample("ip" => "8.8.8.8") do
-        expect(LogStash::Filters::GeoIP.logger).to receive(:error).with(anything, include(:field => "ip"))
-        expect { subject }.to raise_error
+        expect { subject }.to raise_error(java.lang.IllegalArgumentException, "The database provided is invalid or corrupted.")
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-geoip
 version: !ruby/object:Gem::Version
-  version: 4.0.4
+  version: 4.1.1
 platform: java
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2016-11-30 00:00:00.000000000 Z
+date: 2017-05-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -36,7 +36,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  name: jar-dependencies
+  name: logstash-devutils
   prerelease: false
   type: :development
   version_requirements: !ruby/object:Gem::Requirement
@@ -44,27 +44,13 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.3'
-  name: ruby-maven
-  prerelease: false
-  type: :development
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.3'
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  name: logstash-devutils
+  name: benchmark-ips
   prerelease: false
   type: :development
   version_requirements: !ruby/object:Gem::Requirement
@@ -84,22 +70,17 @@ files:
 - LICENSE
 - NOTICE.TXT
 - README.md
-- lib/com/fasterxml/jackson/core/jackson-annotations/2.6.0/jackson-annotations-2.6.0.jar
-- lib/com/fasterxml/jackson/core/jackson-core/2.6.4/jackson-core-2.6.4.jar
-- lib/com/fasterxml/jackson/core/jackson-databind/2.6.4/jackson-databind-2.6.4.jar
-- lib/com/maxmind/db/maxmind-db/1.1.0/maxmind-db-1.1.0.jar
-- lib/com/maxmind/geoip2/geoip2/2.5.0/geoip2-2.5.0.jar
+- docs/index.asciidoc
 - lib/logstash-filter-geoip_jars.rb
 - lib/logstash/filters/geoip.rb
+- lib/logstash/filters/geoip/patch.rb
 - logstash-filter-geoip.gemspec
 - maxmind-db-NOTICE.txt
 - spec/filters/geoip_spec.rb
 - vendor/GeoLite2-City.mmdb
-- vendor/jar-dependencies/runtime-jars/geoip2-2.5.0.jar
-- vendor/jar-dependencies/runtime-jars/jackson-annotations-2.6.0.jar
-- vendor/jar-dependencies/runtime-jars/jackson-core-2.6.4.jar
-- vendor/jar-dependencies/runtime-jars/jackson-databind-2.6.4.jar
-- vendor/jar-dependencies/runtime-jars/maxmind-db-1.1.0.jar
+- vendor/jar-dependencies/com/maxmind/db/maxmind-db/1.2.1/maxmind-db-1.2.1.jar
+- vendor/jar-dependencies/com/maxmind/geoip2/geoip2/2.8.0/geoip2-2.8.0.jar
+- vendor/jar-dependencies/org/logstash/filters/logstash-filter-geoip/4.1.0/logstash-filter-geoip-4.1.0.jar
 homepage: http://www.elastic.co/guide/en/logstash/current/index.html
 licenses:
 - Apache License (2.0)
@@ -110,6 +91,7 @@ post_install_message:
 rdoc_options: []
 require_paths:
 - lib
+- vendor/jar-dependencies
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -120,8 +102,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
-requirements:
-- jar com.maxmind.geoip2:geoip2, 2.5.0, :exclusions=> [com.google.http-client:google-http-client]
+requirements: []
 rubyforge_project:
 rubygems_version: 2.4.8
 signing_key: