logstash-filter-ip2proxy 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 44aa5f88de1b88bd0f6192f49dc0a084fa583bbc
+  data.tar.gz: 8e81ae323854308d4065c36ccc8f219aa6e67951
+SHA512:
+  metadata.gz: 1e72124b5078da4ab9439ecdd3ebd8e43184cf1a35ad93d8b79166f8917c709619788758d2717c0ac6b57940eabcd7b25391d688538ffc6c9a30a82f0bc16bd4
+  data.tar.gz: 3d40f3a530cc40ec254b30ae026429accfc039a29d556741e312771b8e0d23023544c85ec533061f9e9d6d412f9cad14cd0a0e5ed84fd41ae53688e4c2d01d21

data/Gemfile

@@ -0,0 +1,11 @@
+source 'https://rubygems.org'
+
+gemspec
+
+logstash_path = ENV["LOGSTASH_PATH"] || "../../logstash"
+use_logstash_source = ENV["LOGSTASH_SOURCE"] && ENV["LOGSTASH_SOURCE"].to_s == "1"
+
+if Dir.exist?(logstash_path) && use_logstash_source
+  gem 'logstash-core', :path => "#{logstash_path}/logstash-core"
+  gem 'logstash-core-plugin-api', :path => "#{logstash_path}/logstash-core-plugin-api"
+end

data/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2017 IP2Location.com
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

data/README.md

@@ -0,0 +1,72 @@
+# IP2Proxy Filter Plugin
+This is IP2Proxy filter plugin for Logstash that enables Logstash's users to query an IP address if it was being used as open proxy, web proxy, VPN anonymizer and TOR exits. It also appends country, state, city and ISP information of the server. The library took the proxy IP address from **IP2Proxy BIN Data** file.
+
+For the methods to use IP2Proxy filter plugin with Elastic Stack (Elasticsearch, Filebeat, Logstash, and Kibana), please take a look on this [tutorial](https://www.ip2location.com/tutorials/how-to-use-ip2proxy-filter-plugin-with-elastic-stack).
+
+
+## Dependencies (IP2PROXY BIN DATA FILE)
+This plugin requires IP2Proxy BIN data file to function. You may download the BIN data file at
+* IP2Proxy LITE BIN Data (Free): https://lite.ip2location.com
+* IP2Proxy Commercial BIN Data (Commercial): https://www.ip2location.com
+
+
+## Installation
+Install this plugin by the following code:
+```
+bin/logstash-plugin install logstash-filter-ip2proxy
+```
+
+
+## Config File Example
+```
+input {
+  beats {
+    port => "5043"
+  }
+}
+
+filter {
+  grok {
+    match => { "message" => "%{COMBINEDAPACHELOG}"}
+  }
+  ip2proxy {
+    source => "clientip"
+  }
+}
+
+output {
+  elasticsearch {
+    hosts => [ "localhost:9200" ]
+  }
+}
+```
+
+
+## IP2Proxy Filter Configuration
+|Setting|Input type|Required|
+|---|---|---|
+|source|string|Yes|
+|database|a valid filesystem path|No|
+
+* **source** field is a required setting that containing the IP address or hostname to get the ip information.
+* **database** field is an optional setting that containing the path to the IP2Proxy BIN database file.
+
+
+## Sample Output
+|Field|Description|
+|---|---|
+|ip2proxy.city|the city name of the proxy|
+|ip2proxy.country_long|the ISO3166-1 country name of the proxy|
+|ip2proxy.country_short|the ISO3166-1 country code (two-characters) of the proxy|
+|ip2proxy.is_proxy|Check whether if an IP address was a proxy. Returned value:<ul><li>-1 : errors</li><li>0 : not a proxy</li><li>1 : a proxy</li><li>2 : a data center IP address</li></ul>|
+|ip2proxy.isp|the ISP name of the proxy|
+|ip2proxy.proxy_type|the proxy type. Please visit <a href="https://www.ip2location.com/databases/px4-ip-proxytype-country-region-city-isp" target="_blank">IP2Location</a> for the list of proxy types supported|
+|ip2proxy.region|the ISO3166-2 region name of the proxy|
+
+![Example of data](https://www.ip2location.com/images/tutorial/logstash-filter-ip2proxy-screenshot.png)
+
+
+## Support
+Email: support@ip2location.com
+
+URL: [https://www.ip2location.com](https://www.ip2location.com)

data/lib/logstash-filter-ip2proxy_jars.rb

@@ -0,0 +1,3 @@
+require 'jar_dependencies'
+require_jar('com.ip2proxy.ip2proxy', 'ip2proxy', '1.0.1')
+require_jar('org.logstash.filters', 'logstash-filter-ip2proxy', '1.0.0')

data/lib/logstash/filters/ip2proxy.rb

@@ -0,0 +1,50 @@
+# encoding: utf-8
+require "logstash/filters/base"
+require "logstash/namespace"
+
+require "logstash-filter-ip2proxy_jars"
+
+class LogStash::Filters::IP2Proxy < LogStash::Filters::Base
+  config_name "ip2proxy"
+
+  # The path to the IP2Proxy.BIN database file which Logstash should use.
+  # If not specified, this will default to the IP2PROXY-LITE-PX4.BIN database that embedded in the plugin.
+  config :database, :validate => :path
+
+  # The field containing the IP address.
+  # If this field is an array, only the first value will be used.
+  config :source, :validate => :string, :required => true
+
+  # The field used to define iplocation as target.
+  config :target, :validate => :string, :default => 'ip2proxy'
+
+  public
+  def register
+    if @database.nil?
+      @database = ::Dir.glob(::File.join(::File.expand_path("../../../vendor/", ::File.dirname(__FILE__)),"IP2PROXY-LITE-PX4.BIN")).first
+
+      if @database.nil? || !File.exists?(@database)
+        raise "You must specify 'database => ...' in your ip2proxy filter (I looked for '#{@database}')"
+      end
+    end
+
+    @logger.info("Using ip2proxy database", :path => @database)
+    
+    @ip2proxyfilter = org.logstash.filters.IP2ProxyFilter.new(@source, @target, @database)
+  end
+
+  public
+  def filter(event)
+    return unless filter?(event)
+    if @ip2proxyfilter.handleEvent(event)
+      filter_matched(event)
+    else
+      tag_iplookup_unsuccessful(event)
+    end
+  end
+
+  def tag_iplookup_unsuccessful(event)
+    @logger.debug? && @logger.debug("IP #{event.get(@source)} was not found in the database", :event => event)
+  end
+
+end # class LogStash::Filters::IP2Proxy

data/logstash-filter-ip2proxy.gemspec

@@ -0,0 +1,25 @@
+Gem::Specification.new do |s|
+
+  s.name            = 'logstash-filter-ip2proxy'
+  s.version         = '1.0.0'
+  s.licenses        = ['Apache License (2.0)']
+  s.summary         = "Logstash filter IP2Proxy"
+  s.description     = "IP2Proxy filter plugin for Logstash enables Logstash's users to query an IP address if it was being used as open proxy, web proxy, VPN servers and TOR exits. It also appends country, state, city and ISP information of the server."
+  s.authors         = ["IP2Location"]
+  s.email           = 'support@ip2location.com'
+  s.homepage        = "https://www.ip2location.com"
+  s.require_paths   = ["lib", "vendor/jar-dependencies"]
+
+  # Files
+  s.files = Dir["lib/**/*",'spec/**/*',"vendor/**/*","vendor/jar-dependencies/**/*.jar","*.gemspec","*.md","Gemfile","LICENSE"]
+
+  # Tests
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
+  s.add_development_dependency "logstash-devutils"
+end

data/spec/filters/ip2proxy_spec.rb

@@ -0,0 +1,27 @@
+# encoding: utf-8
+require_relative '../spec_helper'
+require "logstash/filters/ip2proxy"
+
+IP2PROXYDB = ::Dir.glob(::File.expand_path("../../vendor/", ::File.dirname(__FILE__))+"/IP2PROXY-LITE-PX4.BIN").first
+
+describe LogStash::Filters::IP2Proxy do
+
+  describe "normal test" do
+    config <<-CONFIG
+      filter {
+        ip2proxy {
+          source => "ip"
+          #database => "#{IP2PROXYDB}"
+        }
+      }
+    CONFIG
+
+    sample("ip" => "8.8.8.8") do
+      expect(subject.get("ip2proxy")).not_to be_empty
+      expect(subject.get("ip2proxy")["country_short"]).to eq("US")
+      end
+    end
+
+  end
+
+end

data/spec/spec_helper.rb

@@ -0,0 +1,2 @@
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"

metadata

@@ -0,0 +1,89 @@
+--- !ruby/object:Gem::Specification
+name: logstash-filter-ip2proxy
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- IP2Location
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2017-11-24 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: logstash-core-plugin-api
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: logstash-devutils
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: IP2Proxy filter plugin for Logstash enables Logstash's users to query
+  an IP address if it was being used as open proxy, web proxy, VPN servers and TOR
+  exits. It also appends country, state, city and ISP information of the server.
+email: support@ip2location.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- Gemfile
+- LICENSE
+- README.md
+- lib/logstash-filter-ip2proxy_jars.rb
+- lib/logstash/filters/ip2proxy.rb
+- logstash-filter-ip2proxy.gemspec
+- spec/filters/ip2proxy_spec.rb
+- spec/spec_helper.rb
+- vendor/IP2PROXY-LITE-PX4.BIN
+- vendor/jar-dependencies/com/ip2proxy/ip2proxy/ip2proxy/1.0.1/ip2proxy-1.0.1.jar
+- vendor/jar-dependencies/org/logstash/filters/logstash-filter-ip2proxy/1.0.0/logstash-filter-ip2proxy-1.0.0.jar
+homepage: https://www.ip2location.com
+licenses:
+- Apache License (2.0)
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: filter
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+- vendor/jar-dependencies
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.6.14
+signing_key: 
+specification_version: 4
+summary: Logstash filter IP2Proxy
+test_files:
+- spec/filters/ip2proxy_spec.rb
+- spec/spec_helper.rb