logstash-filter-virustotal 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5c7d554b9fcd4f6f4b101702b2290861e4a3ef45
-  data.tar.gz: d7bd4ef5214b25ad168a3f99f84f518921babac3
+  metadata.gz: baa784c7b947541a46916511c86a4d2cb44b0b48
+  data.tar.gz: a7536e4a9c47c4d988559245e31e2d354e1a929c
 SHA512:
-  metadata.gz: 7a19b7b82ea169a2a5ee9f89c5b619a445d6c28a7af3a1fe2bb51a871e9892e08978f12333a94503cab5df1a90f044eee60d65b5c5751fa8bbd2c30aff15ebd4
-  data.tar.gz: e38b330dab8deb515cbf750b6281fc23255d7ad3455b55b7b80766981a7278e8bc68c25e09215af4b9754906aead07b104ad197a4508003f84bb6baa5816f187
+  metadata.gz: 4763b679b68bef768352ec51d44d091d0bc5f798a1ca5aae9553305e4f27645b3a7118c0a5c4a0045f14c7add09dc59028d351ca368241878f8b900c62d96f51
+  data.tar.gz: 183b1c7d56aeb1ec6b87cc51704e6d0dbbe8c24c2d6dd8e83584860954210c0a24bdf3eb9c3d52fd9fe51cd054595cab519dfe5d7e47f7fa272e81d0725aaf69

data/lib/logstash/filters/virustotal.rb

@@ -40,20 +40,29 @@ class LogStash::Filters::VirusTotal < LogStash::Filters::Base
       url = "/vtapi/v2/file/report"
     elsif @lookup_type == "url"
       url = "/vtapi/v2/url/report"
+    elsif @lookup_type == "ip"
+          url = "/vtapi/v2/ip-address/report"
     end
 
     connection = Faraday.new baseurl
     begin
       response = connection.get url do |req|
+            if @lookup_type == "ip"
+                  req.params[:ip] = event[@field]
+                else
+                  req.params[:resource] = event[@field]
+                end
         req.params[:resource] = event[@field]
         req.params[:apikey] = @apikey
         req.options.timeout = @timeout
         req.options.open_timeout = @timeout
       end
-      result = JSON.parse(response.body)
-      event[@target] = result
-      # filter_matched should go in the last line of our successful code
-      filter_matched(event)
+      if response.body.length > 2
+          result = JSON.parse(response.body)
+          event[@target] = result
+          # filter_matched should go in the last line of our successful code
+          filter_matched(event)
+      end
 
     rescue Faraday::TimeoutError
       @logger.error("Timeout trying to contact virustotal")

data/logstash-filter-virustotal.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name = 'logstash-filter-virustotal'
-  s.version         = '0.1.2'
+  s.version         = '0.1.3'
   s.licenses = ['Apache License (2.0)']
   s.summary = "This filter queries the Virustotal API"
   s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"

metadata

@@ -1,50 +1,52 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-virustotal
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - CoolAcid
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-08-14 00:00:00.000000000 Z
+date: 2015-12-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core
-  version_requirements: !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.4.0
-    - - <
+    - - "<"
       - !ruby/object:Gem::Version
         version: 2.0.0
-  requirement: !ruby/object:Gem::Requirement
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.4.0
-    - - <
+    - - "<"
       - !ruby/object:Gem::Version
         version: 2.0.0
-  prerelease: false
-  type: :runtime
 - !ruby/object:Gem::Dependency
   name: logstash-devutils
-  version_requirements: !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  requirement: !ruby/object:Gem::Requirement
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  prerelease: false
-  type: :development
-description: This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program
+description: This gem is a logstash plugin required to be installed on top of the
+  Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not
+  a stand-alone program
 email: jakendall@gmail.com
 executables: []
 extensions: []
@@ -64,24 +66,24 @@ licenses:
 metadata:
   logstash_plugin: 'true'
   logstash_group: filter
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project:
-rubygems_version: 2.1.9
-signing_key:
+rubyforge_project: 
+rubygems_version: 2.2.2
+signing_key: 
 specification_version: 4
 summary: This filter queries the Virustotal API
 test_files: