Http filter

Elastic Stack Logstash
1

I have a desire to utilize a rest API call that would reach out to a web service that I would use to determine where the client's location is and tag this data to my event.

I am currently already enriching data using JTDS sql calls, I like how it caches the data so each event that comes in doesn't call to the database each time.

Does the http filter have this kind of logic baked in? I don't want to DDoS our servers by having logstash reach out to this end point on every event looking for a match and appending the value to a field.

Here is my thought process:

  1. call out to rest api get an array of CIDR notated subnet's
  2. take clients IP from event field match the ip to CIDR
  3. take extended attributes from the match and add it to the event

I am hoping I don't have to use Ruby for this as I don't have any sort of debugger setup for this language...

2

I have ruby code working now as I have a development environment for jruby, does anyone have an example I can see for using an http filter for rest call? If you do do you know if the rest api is called on every event that gets ingested by logstash?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.