hi!
Is there a solution?
I would like to decrypt the encrypted code in another script through logstash's ruby filter.
By the way, an error has been issued.
"Could not process event: pad block corrupted"
Could not process event: pad block corrupted {:script_path=>"/home/apps/logstash/config/cipher.rb", :class=>"OpenSSL::Cipher::CipherError", :backtrace=>["org/jruby/ext/openssl/Cipher.java:1201:in final'", "/home/apps/logstash/config/cipher.rb:18:in filter'", "/home/apps/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby/script/context.rb:55:in execute_filter'", "/home/apps/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby/script.rb:30:in execute'", "/home/apps/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby.rb:98:in file_script'", "/home/apps/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby.rb:84:in filter'", "/home/apps/logstash/logstash-core/lib/logstash/filters/base.rb:143:in do_filter'", "/home/apps/logstash/logstash-core/lib/logstash/filters/base.rb:162:in block in multi_filter'", "org/jruby/RubyArray.java:1734:in each'", "/home/apps/logstash/logstash-core/lib/logstash/filters/base.rb:159:in multi_filter'", "/home/apps/logstash/logstash-core/lib/logstash/filter_delegator.rb:44:in multi_filter'", "(eval):96:in block in filter_func'", "/home/apps/logstash/logstash-core/lib/logstash/pipeline.rb:341:in filter_batch'", "/home/apps/logstash/logstash-core/lib/logstash/pipeline.rb:320:in worker_loop'", "/home/apps/logstash/logstash-core/lib/logstash/pipeline.rb:286:in block in start_workers'"]}`
cipher.rb
KEY = "*************"
IV = "*************"
def register(params)
end
def filter(event)
ip_binary = Array(event.get("encrypt_ip")).pack("H*")
cipher = OpenSSL::Cipher::AES.new(128, :CBC)
cipher.decrypt
cipher.iv = KEY
cipher.key = IV
ip_decrypt = cipher.update(ip_binary) + cipher.final
#return [event]
end