I have a desire to utilize a rest API call that would reach out to a web service that I would use to determine where the client's location is and tag this data to my event.
I am currently already enriching data using JTDS sql calls, I like how it caches the data so each event that comes in doesn't call to the database each time.
Does the http filter have this kind of logic baked in? I don't want to DDoS our servers by having logstash reach out to this end point on every event looking for a match and appending the value to a field.
Here is my thought process:
- call out to rest api get an array of CIDR notated subnet's
- take clients IP from event field match the ip to CIDR
- take extended attributes from the match and add it to the event
I am hoping I don't have to use Ruby for this as I don't have any sort of debugger setup for this language...