logstash-filter-ip2location 2.4.0 → 2.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d4bb20dd4cbf1bc67c3d2b830dae8ea2b177f02f2de8b791a32518976a1ca1ef
-  data.tar.gz: 2f8d442c7fd1a9ce015787ba0007461bbeb111d23e31c97b21d7d081d81e3955
+  metadata.gz: a61e61abf0196170c710073bf5db2d9e504a892427e1b3e69511570b535345f9
+  data.tar.gz: 9bd9a605d5bfa025dea55f1c33058f95b2eae477d3f1f4e4738897c396325fc1
 SHA512:
-  metadata.gz: 07a89765b87e4118af8c712ccdc1f059a1264620969750acbe538581431f4603870693ec13326290c387223a2f578beab248f63e3eaedffb12363268340ff509
-  data.tar.gz: 37e61c13642940521c6ecb3d0bcd38ece0fc7316012e7f44d6df2c3958ae37b25c5411903a16c958f8d626e2961dd76b8ffb920d5b6878e67f2dda96fdc4fa06
+  metadata.gz: c2a29c9f4d10c260a0b68ee771427045fd61ed621aff80d4c800d1164d3978e68fa57d5090911e577afb94c5c46e85a0aefa67a4be3d13c778eaf8005fe8e356
+  data.tar.gz: bf2b3e8df1f696d2730f37d71ed733ae65a907555dd7ee38e0a7fbc313de23b7ec56baf66462386804a78f34be76114e10a993233037f38f94acf543907c9165

data/Gemfile

@@ -1,11 +1,11 @@
-source 'https://rubygems.org'
-
-gemspec
-
-logstash_path = ENV["LOGSTASH_PATH"] || "../../logstash"
-use_logstash_source = ENV["LOGSTASH_SOURCE"] && ENV["LOGSTASH_SOURCE"].to_s == "1"
-
-if Dir.exist?(logstash_path) && use_logstash_source
-  gem 'logstash-core', :path => "#{logstash_path}/logstash-core"
-  gem 'logstash-core-plugin-api', :path => "#{logstash_path}/logstash-core-plugin-api"
-end
+source 'https://rubygems.org'
+
+gemspec
+
+logstash_path = ENV["LOGSTASH_PATH"] || "../../logstash"
+use_logstash_source = ENV["LOGSTASH_SOURCE"] && ENV["LOGSTASH_SOURCE"].to_s == "1"
+
+if Dir.exist?(logstash_path) && use_logstash_source
+  gem 'logstash-core', :path => "#{logstash_path}/logstash-core"
+  gem 'logstash-core-plugin-api', :path => "#{logstash_path}/logstash-core-plugin-api"
+end

data/LICENSE

@@ -1,13 +1,13 @@
-Copyright (c) 2023 IP2Location.com
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
+Copyright (c) 2025 IP2Location.com
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
 limitations under the License.

data/README.md

@@ -1,130 +1,164 @@
-# IP2Location Filter Plugin
-This is IP2Location filter plugin for Logstash that enables Logstash's users to add geolocation information such as country, region, district, city, latitude, longitude, ZIP code, time zone, Internet Service Provider (ISP), domain name, connection speed, IDD code, area code, weather station code, weather station name, mobile country code (MCC), mobile network code (MNC), mobile brand, elevation, usage type, address type, IAB category and ASN by IP address. The library reads the geo location information from **IP2Location BIN data** file.
-
-Supported IPv4 and IPv6 address.
-
-For the methods to use IP2Location filter plugin with Elastic Stack (Elasticsearch, Filebeat, Logstash, and Kibana), please take a look on this [tutorial](https://www.ip2location.com/tutorials/how-to-use-ip2location-filter-plugin-with-elastic-stack).
-
-*Note: This plugin works in Logstash 7 and Logstash 8.*
-
-
-## Dependencies (IP2LOCATION BIN DATA FILE)
-This plugin requires IP2Location BIN data file to function. You may download the BIN data file at
-* IP2Location LITE BIN Data (Free): https://lite.ip2location.com
-* IP2Location Commercial BIN Data (Commercial): https://www.ip2location.com
-
-
-## Installation
-Install this plugin by the following code:
-```
-bin/logstash-plugin install logstash-filter-ip2location
-```
-
-
-## Config File Example 1
-```
-input {
-  beats {
-    port => "5043"
-  }
-}
-
-filter {
-  grok {
-    match => { "message" => "%{COMBINEDAPACHELOG}"}
-  }
-  ip2location {
-    source => "[source][address]"
-  }
-}
-
-
-output {
-  elasticsearch {
-    hosts => [ "localhost:9200" ]
-  }
-}
-```
-
-
-## Config File Example 2
-```
-input {
-  beats {
-    port => "5043"
-  }
-}
-
-filter {
-  grok {
-    match => { "message" => "%{COMBINEDAPACHELOG}"}
-  }
-  ip2location {
-    source => "[source][address]"
-    # Set path to the database located
-    database => "IP2LOCATION_BIN_DATABASE_FILESYSTEM_PATH"
-    # Enable memory mapped to be used
-    use_memory_mapped => true
-  }
-}
-
-
-output {
-  elasticsearch {
-    hosts => [ "localhost:9200" ]
-  }
-}
-```
-
-
-## IP2Location Filter Configuration
-|Setting|Input type|Required|
-|---|---|---|
-|source|string|Yes|
-|database|a valid filesystem path|No|
-|use_memory_mapped|boolean|No|
-|use_cache|boolean|No|
-|hide_unsupported_fields|boolean|No|
-
-* **source** field is a required setting that containing the IP address or hostname to get the ip information.
-* **database** field is an optional setting that containing the path to the IP2Location BIN database file.
-* **use_memory_mapped** field is an optional setting that used to allow user to enable the use of memory mapped file. Default value is false.
-* **use_cache** field is an optional setting that used to allow user to enable the use of cache. Default value is true.
-* **hide_unsupported_fields** field is an optional setting that used to allow user to hide unsupported fields. Default value is false.
-
-
-## Sample Output
-|Field|Description|
-|---|---|
-|ip2location.address_type|the IP address type (A-Anycast, B-Broadcast, M-Multicast & U-Unicast) of IP address or domain name|
-|ip2location.area_code|the varying length number assigned to geographic areas for call between cities|
-|ip2location.as|Autonomous system (AS) name|
-|ip2location.asn|the Autonomous system number (ASN)|
-|ip2location.category|the IAB content taxonomy category of IP address or domain name|
-|ip2location.city|the city name|
-|ip2location.country_long|the country name based on ISO 3166|
-|ip2location.country_short|the two-character country code based on ISO 3166|
-|ip2location.district|the district or county name|
-|ip2location.domain|the Internet domain name associated to IP address range|
-|ip2location.elevation|the elevation|
-|ip2location.idd_code|the IDD prefix to call the city from another country|
-|ip2location.ip_address|the IP address|
-|ip2location.isp|the Internet Service Provider (ISP) name|
-|ip2location.latitude|the city latitude|
-|ip2location.location|the city location|
-|ip2location.longitude|the city longitude|
-|ip2location.mcc|the mobile country code|
-|ip2location.mnc|mobile network code|
-|ip2location.mobile_brand|the mobile brand|
-|ip2location.net_speed|the Internet Connection Speed (DIAL) DIAL-UP,(DSL) DSL/CABLE or(COMP) COMPANY|
-|ip2location.region|the region or state name|
-|ip2location.time_zone|the Time zone in UTC (Coordinated Universal Time)|
-|ip2location.usage_type|the usage type|
-|ip2location.weather_station_code|the special code to identify the nearest weather observation station|
-|ip2location.weather_station_name|the name of the nearest weather observation station|
-|ip2location.zip_code|the ZIP code|
-
-
-## Support
-Email: support@ip2location.com  
-URL: [https://www.ip2location.com](https://www.ip2location.com)
+# IP2Location Filter Plugin
+This is IP2Location filter plugin for Logstash that enables Logstash's users to add geolocation information such as country, region, district, city, latitude, longitude, ZIP code, time zone, Internet Service Provider (ISP), domain name, connection speed, IDD code, area code, weather station code, weather station name, mobile country code (MCC), mobile network code (MNC), mobile brand, elevation, usage type, address type, IAB category, ASN, AS domain, AS usage type and AS CIDR by IP address. The library reads the geolocation information from **IP2Location BIN data** file and **IP2Location.io** data.
+
+Supported IPv4 and IPv6 address.
+
+For the methods to use IP2Location filter plugin with Elastic Stack (Elasticsearch, Filebeat, Logstash, and Kibana), please take a look on this [tutorial](https://www.ip2location.com/tutorials/how-to-use-ip2location-filter-plugin-with-elastic-stack).
+
+*Note: This plugin works in Logstash 7, 8 and 9.*
+
+
+## Dependencies (IP2LOCATION BIN DATA FILE)
+This plugin requires IP2Location BIN data file to function. You may download the BIN data file at
+* IP2Location LITE BIN Data (Free): https://lite.ip2location.com
+* IP2Location Commercial BIN Data (Commercial): https://www.ip2location.com
+
+## Dependencies (IP2LOCATION.IO DATA)
+This plugin requires API key to function. You may sign up for a free API key at https://www.ip2location.io/pricing.
+
+
+## Installation
+Install this plugin by the following code:
+```
+bin/logstash-plugin install logstash-filter-ip2location
+```
+
+
+## Config File Example 1
+```
+input {
+  beats {
+    port => "5043"
+  }
+}
+
+filter {
+  grok {
+    match => { "message" => "%{COMBINEDAPACHELOG}"}
+  }
+  ip2location {
+    source => "[source][address]"
+  }
+}
+
+output {
+  elasticsearch {
+    hosts => [ "localhost:9200" ]
+  }
+}
+```
+
+## Config File Example 2
+```
+input {
+  beats {
+    port => "5043"
+  }
+}
+
+filter {
+  grok {
+    match => { "message" => "%{COMBINEDAPACHELOG}"}
+  }
+  ip2location {
+    source => "[source][address]"
+    # Set path to the database located
+    database => "IP2LOCATION_BIN_DATABASE_FILESYSTEM_PATH"
+    # Enable memory mapped to be used
+    use_memory_mapped => true
+  }
+}
+
+output {
+  elasticsearch {
+    hosts => [ "localhost:9200" ]
+  }
+}
+```
+
+## Config File Example 3 using IP2Location.io
+```
+input {
+  beats {
+    port => "5043"
+  }
+}
+
+filter {
+  grok {
+    match => { "message" => "%{COMBINEDAPACHELOG}"}
+  }
+  ip2location {
+    source => "[source][address]"
+    lookup_type => "ws"
+    api_key => "YOUR_API_KEY"
+  }
+}
+
+
+output {
+  elasticsearch {
+    hosts => [ "localhost:9200" ]
+  }
+}
+```
+
+
+## IP2Location Filter Configuration
+|Setting|Input type|Required|
+|---|---|---|
+|source|string|Yes|
+|database|a valid filesystem path|No|
+|use_memory_mapped|boolean|No|
+|use_cache|boolean|No|
+|lookup_type|string|No|
+|api_key|string|No|
+|hide_unsupported_fields|boolean|No|
+
+* **source** field is a required setting that containing the IP address or hostname to get the ip information.
+* **database** field is an optional setting that containing the path to the IP2Location BIN database file.
+* **use_memory_mapped** field is an optional setting that used to allow user to enable the use of memory mapped file. Default value is false.
+* **use_cache** field is an optional setting that used to allow user to enable the use of cache. Default value is true.
+* **lookup_type** field is an optional setting that used to allow user to decide the lookup method either using IP2Location BIN database file(db) or IP2Location.io data(ws). Default value is db.
+* **api_key** field is an optional setting that used to allow user to set the API Key of the IP2Location.io lookup.
+* **hide_unsupported_fields** field is an optional setting that used to allow user to hide unsupported fields. Default value is false.
+
+
+## Sample Output
+|Field|Description|
+|---|---|
+|ip2location.address_type|the IP address type (A-Anycast, B-Broadcast, M-Multicast & U-Unicast) of IP address or domain name|
+|ip2location.area_code|the varying length number assigned to geographic areas for call between cities|
+|ip2location.as|Autonomous system (AS) name|
+|ip2location.asn|the Autonomous system number (ASN)|
+|ip2location.as_cidr|CIDR range for the whole AS|
+|ip2location.as_domain|Domain name of the AS registrant|
+|ip2location.as_usage_type|Usage type of the AS registrant|
+|ip2location.category|the IAB content taxonomy category of IP address or domain name|
+|ip2location.city|the city name|
+|ip2location.country_long|the country name based on ISO 3166|
+|ip2location.country_short|the two-character country code based on ISO 3166|
+|ip2location.district|the district or county name|
+|ip2location.domain|the Internet domain name associated to IP address range|
+|ip2location.elevation|the elevation|
+|ip2location.idd_code|the IDD prefix to call the city from another country|
+|ip2location.ip_address|the IP address|
+|ip2location.isp|the Internet Service Provider (ISP) name|
+|ip2location.latitude|the city latitude|
+|ip2location.location|the city location|
+|ip2location.longitude|the city longitude|
+|ip2location.mcc|the mobile country code|
+|ip2location.mnc|mobile network code|
+|ip2location.mobile_brand|the mobile brand|
+|ip2location.net_speed|the Internet Connection Speed (DIAL) DIAL-UP,(DSL) DSL/CABLE or(COMP) COMPANY|
+|ip2location.region|the region or state name|
+|ip2location.time_zone|the Time zone in UTC (Coordinated Universal Time)|
+|ip2location.usage_type|the usage type|
+|ip2location.weather_station_code|the special code to identify the nearest weather observation station|
+|ip2location.weather_station_name|the name of the nearest weather observation station|
+|ip2location.zip_code|the ZIP code|
+
+
+## Support
+Email: support@ip2location.com  
+URL: [https://www.ip2location.com](https://www.ip2location.com)

data/lib/logstash/filters/ip2location.rb

@@ -1,175 +1,195 @@
-# encoding: utf-8
-require "logstash/filters/base"
-require "logstash/namespace"
-
-require "logstash-filter-ip2location_jars"
-
-require 'thread'
-
-
-class LogStash::Filters::IP2Location < LogStash::Filters::Base
-  config_name "ip2location"
-
-  # The path to the IP2Location.BIN database file which Logstash should use.
-  # If not specified, this will default to the IP2LOCATION-LITE-DB1.IPV6.BIN database that embedded in the plugin.
-  config :database, :validate => :path
-
-  # The field containing the IP address.
-  # If this field is an array, only the first value will be used.
-  config :source, :validate => :string, :required => true
-
-  # The field used to define iplocation as target.
-  config :target, :validate => :string, :default => 'ip2location'
-
-  # The field used to allow user to enable the use of cache.
-  config :use_cache, :validate => :boolean, :default => true
-
-  # The field used to allow user to enable the use of memory mapped file.
-  config :use_memory_mapped, :validate => :boolean, :default => false
-
-  # The field used to allow user to hide unsupported fields.
-  config :hide_unsupported_fields, :validate => :boolean, :default => false
-
-  # The field used to define the size of the cache. It is not required and the default value is 10 000 
-  config :cache_size, :validate => :number, :required => false, :default => 10_000
-
-  public
-  def register
-    if @database.nil?
-      @database = ::Dir.glob(::File.join(::File.expand_path("../../../vendor/", ::File.dirname(__FILE__)),"IP2LOCATION-LITE-DB1.IPV6.BIN")).first
-
-      if @database.nil? || !File.exists?(@database)
-        raise "You must specify 'database => ...' in your ip2location filter (I looked for '#{@database}')"
-      end
-    end
-
-    @logger.info("Using ip2location database", :path => @database)
-
-    @ip2locationfilter = org.logstash.filters.IP2LocationFilter.new(@source, @target, @database, @use_memory_mapped, @hide_unsupported_fields)
-  end
-
-  public
-  def filter(event)
-    ip = event.get(@source)
-
-    return unless filter?(event)
-    if @use_cache
-      if value = IP2LocationCache.find(event, ip, @ip2locationfilter, @cache_size).get('ip2location')
-        event.set('ip2location', value)
-        filter_matched(event)
-      else
-        tag_iplookup_unsuccessful(event)
-      end
-    else
-      if @ip2locationfilter.handleEvent(event)
-        filter_matched(event)
-      else
-        tag_iplookup_unsuccessful(event)
-      end
-    end
-  end
-
-  def tag_iplookup_unsuccessful(event)
-    @logger.debug? && @logger.debug("IP #{event.get(@source)} was not found in the database", :event => event)
-  end
-
-end # class LogStash::Filters::IP2Location
-
-class IP2LocationOrderedHash
-  ONE = 1
-
-  attr_reader :times_queried # ip -> times queried
-  attr_reader :hash
-
-  def initialize
-    @times_queried = Hash.new(0) # ip -> times queried
-    @hash = {} # number of hits -> array of ips
-  end
-
-  def add(key)
-    hash[ONE] ||= []
-    hash[ONE] << key
-    times_queried[key] = ONE
-  end
-
-  def reorder(key)
-    number_of_queries = times_queried[key]
-
-    hash[number_of_queries].delete(key)
-    hash.delete(number_of_queries) if hash[number_of_queries].empty?
-
-    hash[number_of_queries + 1] ||= []
-    hash[number_of_queries + 1] << key
-  end
-
-  def increment(key)
-    add(key) unless times_queried.has_key?(key)
-    reorder(key)
-    times_queried[key] += 1
-  end
-
-  def delete_least_used
-    first_pile_with_someting.shift.tap { |key| times_queried.delete(key) }
-  end
-
-  def first_pile_with_someting
-    hash[hash.keys.min]
-  end
-end
-
-class IP2LocationCache
-  ONE_DAY_IN_SECONDS = 86_400
-
-  @cache         = {}            # ip -> event
-  @timestamps    = {}            # ip -> time of caching
-  @times_queried = IP2LocationOrderedHash.new # ip -> times queried
-  @mutex         = Mutex.new
-
-  class << self
-    attr_reader :cache
-    attr_reader :timestamps
-    attr_reader :times_queried
-
-
-    def find(event, ip, filter, cache_size)
-      synchronize do
-        if cache.has_key?(ip)
-          refresh_event(event, ip, filter) if too_old?(ip)
-        else
-          if cache_full?(cache_size)
-            make_room
-          end
-          cache_event(event, ip, filter)
-        end
-        times_queried.increment(ip)
-        cache[ip]
-      end
-    end
-
-    def too_old?(ip)
-      timestamps[ip] < Time.now - ONE_DAY_IN_SECONDS
-    end
-
-    def make_room
-      key = times_queried.delete_least_used
-      cache.delete(key)
-      timestamps.delete(key)
-    end
-
-    def cache_full?(cache_size)
-      cache.size >= cache_size
-    end
-
-    def cache_event(event, ip, filter)
-      filter.handleEvent(event)
-      cache[ip] = event
-      timestamps[ip] = Time.now
-    end
-
-    def synchronize(&block)
-      @mutex.synchronize(&block)
-    end
-
-    alias_method :refresh_event, :cache_event
-  end
-end
+# encoding: utf-8
+require "logstash/filters/base"
+require "logstash/namespace"
+
+require "logstash-filter-ip2location_jars"
+
+require 'thread'
+
+
+class LogStash::Filters::IP2Location < LogStash::Filters::Base
+  config_name "ip2location"
+
+  # The path to the IP2Location.BIN database file which Logstash should use.
+  # If not specified, this will default to the IP2LOCATION-LITE-DB1.IPV6.BIN database that embedded in the plugin.
+  config :database, :validate => :path
+
+  # The field containing the IP address.
+  # If this field is an array, only the first value will be used.
+  config :source, :validate => :string, :required => true
+
+  # The field used to define ip2location as target.
+  config :target, :validate => :string, :default => 'ip2location'
+
+  # The field used to allow user to enable the use of cache.
+  config :use_cache, :validate => :boolean, :default => true
+
+  # The field used to allow user to enable the use of memory mapped file.
+  config :use_memory_mapped, :validate => :boolean, :default => false
+
+  # The field used to allow user to hide unsupported fields.
+  config :hide_unsupported_fields, :validate => :boolean, :default => false
+
+  # The field used to define lookup type.
+  config :lookup_type, :validate => :string, :default => 'db'
+
+  # The field used to define the apikey of IP2location.io.
+  config :api_key, :validate => :string, :default => ''
+
+  # The field used to define the size of the cache. It is not required and the default value is 10 000 
+  config :cache_size, :validate => :number, :required => false, :default => 10_000
+
+  public
+  def register
+    if @lookup_type == "ws"
+      @logger.info("Using IP2Location.io API")
+      if @api_key == ""
+        raise "An IP2Location.io API key is required. You may sign up for a free API key at https://www.ip2location.io/pricing."
+      end
+    else
+      if @database.nil?
+        @database = ::Dir.glob(::File.join(::File.expand_path("../../../vendor/", ::File.dirname(__FILE__)),"IP2LOCATION-LITE-DB1.IPV6.BIN")).first
+  
+        if @database.nil? || !File.exists?(@database)
+          raise "You must specify 'database => ...' in your ip2location filter (I looked for '#{@database}')"
+        end
+      end
+      @logger.info("Using ip2location database", :path => @database)
+    end
+
+    @ip2locationfilter = org.logstash.filters.IP2LocationFilter.new(@source, @target, @database, @use_memory_mapped, @hide_unsupported_fields, @lookup_type, @api_key)
+  end
+
+  public
+  def filter(event)
+    ip = event.get(@source)
+
+    return unless filter?(event)
+    if @lookup_type == "ws"
+      if @ip2locationfilter.handleEvent(event)
+        filter_matched(event)
+      else
+        tag_iplookup_unsuccessful(event)
+      end
+    else
+      if @use_cache
+        if value = IP2LocationCache.find(event, ip, @ip2locationfilter, @cache_size).get('ip2location')
+          event.set('ip2location', value)
+          filter_matched(event)
+        else
+          tag_iplookup_unsuccessful(event)
+        end
+      else
+        if @ip2locationfilter.handleEvent(event)
+          filter_matched(event)
+        else
+          tag_iplookup_unsuccessful(event)
+        end
+      end
+    end
+  end
+
+  def tag_iplookup_unsuccessful(event)
+    @logger.debug? && @logger.debug("IP #{event.get(@source)} was not found in the database", :event => event)
+  end
+
+end # class LogStash::Filters::IP2Location
+
+class IP2LocationOrderedHash
+  ONE = 1
+
+  attr_reader :times_queried # ip -> times queried
+  attr_reader :hash
+
+  def initialize
+    @times_queried = Hash.new(0) # ip -> times queried
+    @hash = {} # number of hits -> array of ips
+  end
+
+  def add(key)
+    hash[ONE] ||= []
+    hash[ONE] << key
+    times_queried[key] = ONE
+  end
+
+  def reorder(key)
+    number_of_queries = times_queried[key]
+
+    hash[number_of_queries].delete(key)
+    hash.delete(number_of_queries) if hash[number_of_queries].empty?
+
+    hash[number_of_queries + 1] ||= []
+    hash[number_of_queries + 1] << key
+  end
+
+  def increment(key)
+    add(key) unless times_queried.has_key?(key)
+    reorder(key)
+    times_queried[key] += 1
+  end
+
+  def delete_least_used
+    first_pile_with_someting.shift.tap { |key| times_queried.delete(key) }
+  end
+
+  def first_pile_with_someting
+    hash[hash.keys.min]
+  end
+end
+
+class IP2LocationCache
+  ONE_DAY_IN_SECONDS = 86_400
+
+  @cache         = {}            # ip -> event
+  @timestamps    = {}            # ip -> time of caching
+  @times_queried = IP2LocationOrderedHash.new # ip -> times queried
+  @mutex         = Mutex.new
+
+  class << self
+    attr_reader :cache
+    attr_reader :timestamps
+    attr_reader :times_queried
+
+
+    def find(event, ip, filter, cache_size)
+      synchronize do
+        if cache.has_key?(ip)
+          refresh_event(event, ip, filter) if too_old?(ip)
+        else
+          if cache_full?(cache_size)
+            make_room
+          end
+          cache_event(event, ip, filter)
+        end
+        times_queried.increment(ip)
+        cache[ip]
+      end
+    end
+
+    def too_old?(ip)
+      timestamps[ip] < Time.now - ONE_DAY_IN_SECONDS
+    end
+
+    def make_room
+      key = times_queried.delete_least_used
+      cache.delete(key)
+      timestamps.delete(key)
+    end
+
+    def cache_full?(cache_size)
+      cache.size >= cache_size
+    end
+
+    def cache_event(event, ip, filter)
+      filter.handleEvent(event)
+      cache[ip] = event
+      timestamps[ip] = Time.now
+    end
+
+    def synchronize(&block)
+      @mutex.synchronize(&block)
+    end
+
+    alias_method :refresh_event, :cache_event
+  end
+end

data/lib/logstash-filter-ip2location_jars.rb

@@ -1,3 +1,4 @@
-require 'jar_dependencies'
-require_jar('com.ip2location.ip2location', 'ip2location', '8.11.0')
-require_jar('org.logstash.filters', 'logstash-filter-ip2location', '2.4.0')
+require 'jar_dependencies'
+require_jar('com.ip2location.ip2location', 'ip2location', '8.13.0')
+require_jar('com.google.gson', 'gson', '2.11.0')
+require_jar('org.logstash.filters', 'logstash-filter-ip2location', '2.6.0')

data/logstash-filter-ip2location.gemspec

@@ -1,25 +1,25 @@
-Gem::Specification.new do |s|
-
-  s.name            = 'logstash-filter-ip2location'
-  s.version         = '2.4.0'
-  s.licenses        = ['Apache-2.0']
-  s.summary         = "Logstash filter IP2Location"
-  s.description     = "IP2Location filter plugin for Logstash enables Logstash's users to add geolocation information such as country, state, district, city, latitude, longitude, ZIP code, time zone, ISP, domain name, connection speed, IDD code, area code, weather station code, weather station name, MNC, MCC, mobile brand, elevation, usage type, address type, IAB category and ASN by IP address."
-  s.authors         = ["IP2Location"]
-  s.email           = 'support@ip2location.com'
-  s.homepage        = "https://www.ip2location.com"
-  s.require_paths   = ["lib", "vendor/jar-dependencies"]
-
-  # Files
-  s.files = Dir["lib/**/*",'spec/**/*',"vendor/**/*","vendor/jar-dependencies/**/*.jar","*.gemspec","*.md","Gemfile","LICENSE"]
-
-  # Tests
-  s.test_files = s.files.grep(%r{^(test|spec|features)/})
-
-  # Special flag to let us know this is actually a logstash plugin
-  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
-
-  # Gem dependencies
-  s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
-  s.add_development_dependency "logstash-devutils"
-end
+Gem::Specification.new do |s|
+
+  s.name            = 'logstash-filter-ip2location'
+  s.version         = '2.6.0'
+  s.licenses        = ['Apache-2.0']
+  s.summary         = "Logstash filter IP2Location"
+  s.description     = "IP2Location filter plugin for Logstash enables Logstash's users to add geolocation information such as country, state, district, city, latitude, longitude, ZIP code, time zone, ISP, domain name, connection speed, IDD code, area code, weather station code, weather station name, MNC, MCC, mobile brand, elevation, usage type, address type, IAB category, ASN, AS domain, AS usage type and AS CIDR by IP address."
+  s.authors         = ["IP2Location"]
+  s.email           = 'support@ip2location.com'
+  s.homepage        = "https://www.ip2location.com"
+  s.require_paths   = ["lib", "vendor/jar-dependencies"]
+
+  # Files
+  s.files = Dir["lib/**/*",'spec/**/*',"vendor/**/*","vendor/jar-dependencies/**/*.jar","*.gemspec","*.md","Gemfile","LICENSE"]
+
+  # Tests
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
+  s.add_development_dependency "logstash-devutils"
+end

data/spec/filters/ip2location_spec.rb

@@ -1,32 +1,32 @@
-# encoding: utf-8
-require_relative '../spec_helper'
-require "logstash/filters/ip2location"
-
-IP2LOCATIONDB = ::Dir.glob(::File.expand_path("../../vendor/", ::File.dirname(__FILE__))+"/IP2LOCATION-LITE-DB1.IPV6.BIN").first
-
-describe LogStash::Filters::IP2Location do
-
-  describe "normal test" do
-    config <<-CONFIG
-      filter {
-        ip2location {
-          source => "ip"
-          #database => "#{IP2LOCATIONDB}"
-        }
-      }
-    CONFIG
-
-    sample("ip" => "8.8.8.8") do
-      expect(subject.get("ip2location")).not_to be_empty
-      expect(subject.get("ip2location")["country_short"]).to eq("US")
-      end
-    end
-
-    sample("ip" => "2a01:04f8:0d16:26c2::") do
-      expect(subject.get("ip2location")).not_to be_empty
-      expect(subject.get("ip2location")["country_short"]).to eq("DE")
-      end
-    end
-  end
-
+# encoding: utf-8
+require_relative '../spec_helper'
+require "logstash/filters/ip2location"
+
+IP2LOCATIONDB = ::Dir.glob(::File.expand_path("../../vendor/", ::File.dirname(__FILE__))+"/IP2LOCATION-LITE-DB1.IPV6.BIN").first
+
+describe LogStash::Filters::IP2Location do
+
+  describe "normal test" do
+    config <<-CONFIG
+      filter {
+        ip2location {
+          source => "ip"
+          #database => "#{IP2LOCATIONDB}"
+        }
+      }
+    CONFIG
+
+    sample("ip" => "8.8.8.8") do
+      expect(subject.get("ip2location")).not_to be_empty
+      expect(subject.get("ip2location")["country_short"]).to eq("US")
+      end
+    end
+
+    sample("ip" => "2a01:04f8:0d16:26c2::") do
+      expect(subject.get("ip2location")).not_to be_empty
+      expect(subject.get("ip2location")["country_short"]).to eq("DE")
+      end
+    end
+  end
+
 end

data/spec/spec_helper.rb

@@ -1,2 +1,2 @@
-# encoding: utf-8
-require "logstash/devutils/rspec/spec_helper"
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-ip2location
 version: !ruby/object:Gem::Version
-  version: 2.4.0
+  version: 2.6.0
 platform: ruby
 authors:
 - IP2Location
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-04-12 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core-plugin-api
@@ -42,7 +41,7 @@ description: IP2Location filter plugin for Logstash enables Logstash's users to
   geolocation information such as country, state, district, city, latitude, longitude,
   ZIP code, time zone, ISP, domain name, connection speed, IDD code, area code, weather
   station code, weather station name, MNC, MCC, mobile brand, elevation, usage type,
-  address type, IAB category and ASN by IP address.
+  address type, IAB category, ASN, AS domain, AS usage type and AS CIDR by IP address.
 email: support@ip2location.com
 executables: []
 extensions: []
@@ -57,15 +56,15 @@ files:
 - spec/filters/ip2location_spec.rb
 - spec/spec_helper.rb
 - vendor/IP2LOCATION-LITE-DB1.IPV6.BIN
-- vendor/jar-dependencies/com/ip2location/ip2location/ip2location/8.11.0/ip2location-8.11.0.jar
-- vendor/jar-dependencies/org/logstash/filters/logstash-filter-ip2location/2.4.0/logstash-filter-ip2location-2.4.0.jar
+- vendor/jar-dependencies/com/google/gson/gson/2.11.0/gson-2.11.0.jar
+- vendor/jar-dependencies/com/ip2location/ip2location/ip2location/8.13.0/ip2location-8.13.0.jar
+- vendor/jar-dependencies/org/logstash/filters/logstash-filter-ip2location/2.6.0/logstash-filter-ip2location-2.6.0.jar
 homepage: https://www.ip2location.com
 licenses:
 - Apache-2.0
 metadata:
   logstash_plugin: 'true'
   logstash_group: filter
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -81,8 +80,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
-signing_key:
+rubygems_version: 3.7.1
 specification_version: 4
 summary: Logstash filter IP2Location
 test_files: