Nagios Support Forum

Code: Select all

  ruby {
    code => "
      File.open('/tmp/mydebug.log','a') { |f| f.puts event['x-forwarded-for'] }
      event['clientip'] = 'testing'
    "
  }

Code: Select all

  ruby {
    code => "
      require 'ipaddr'
      event['clientip'] = IPAddr.new(event['c-ip']).strip.to_i
    "
  }

Code: Select all

cat IPtest01.conf
input {
  stdin { }
}

# The following data is the input - pasted in
# 02:36.01 /var/log/Service1/myapp.log 131.198.86.206 Ruby is great
filter {

  # test things here
  grok {
    match => { "message" => "%{DATA:justtime} %{DATA:logsource} %{IPORHOST:c-ip} %{GREEDYDATA:msg}" }
  } #
  # incorrectly autopopulates to first day of year
  date {
    match => [ "justtime", "HH:mm.ss" ]
    target => "incorrectfulldatetime"
    timezone => "America/Los_Angeles"
  } # date

  # use ruby to augment with current day
  ruby {
    code => "
      event['fulldatetime'] = Time.now.strftime('%Y-%m-%d') + ' ' + event['justtime']
    "
  }
  date {
    match => [ "fulldatetime", "YYYY-MM-dd HH:mm.ss" ]
    target => "correctfulldatetime"
    timezone => "America/Los_Angeles"
  } # date

  # split apart log source to extract service name
  ruby {
    code => "
      fpath = event['logsource'].split('/')
      event['serviceName'] = fpath[fpath.length-2].downcase
    "
  }
  ruby {
    code => "
      require 'ipaddr'
      decimalip = event['c-ip']
      event['clientip'] = IPAddr.new(decimalip,Socket::AF_INET).to_i
    "
  }

}

output {
  stdout {
    codec => rubydebug
  }
}

Code: Select all

if [x-forwarded-for] {
  ruby {
    code => "require 'ipaddr'
      decimalip = event['x-forwarded-for']
      event['clientip'] = IPAddr.new(decimalip,Socket::AF_INET).to_i"
  }
  geoip {
    database => "/usr/share/GeoIP/GeoLite2-City.mmdb"
    source => "x-forwarded-for"
  }
}
else if [c-ip] {
  ruby {
    code => "require 'ipaddr'
      decimalip = event['c-ip']
      event['clientip'] = IPAddr.new(decimalip,Socket::AF_INET).to_i"
  }
  geoip {
    database => "/usr/share/GeoIP/GeoLite2-City.mmdb"
    source => "c-ip"
  }
}

Code: Select all

cd /usr/local/nagioslogserver/logstash
bin/logstash-plugin install logstash-filter-jdbc_static

Code: Select all

  jdbc_static {
    loaders => [
      {
        id => "remote-geoips"
        query => "SELECT
                  startrange, endrange, building,
                  geoiplongitude, geoiplatitude, geoiplocation,
                  geoipcity, geoiptime_zone, geoipcontinent_code,
                  geoipcountry_code3, geoipcountry_code2, geoipcountry_name
                  FROM mydatabase ORDER BY startrange"
        local_table => "local-geoips"
      }
    ]
    local_db_objects => [
      {
        name => "local-geoips"
        index_columns => ["startrange"]
        columns => [
          ["startrange", "int(10) unsigned"],
          ["endrange", "int(10) unsigned"],
          ["building", "varchar(8)"],
          ["geoiplongitude", "decimal(11,8)"],
          ["geoiplatitude", "decimal(10,8)"],
          ["geoiplocation", "varchar(64)"],
          ["geoipcity", "varchar(64)"],
          ["geoiptime_zone", "varchar(64)"],
          ["geoipcontinent_code", "varchar(2)"],
          ["geoipcountry_code3", "varchar(3)"],
          ["geoipcountry_code2", "varchar(2)"],
          ["geoipcountry_name", "varchar(64)"]
        ]
      }
    ]
    local_lookups => [
      {
        query => "SELECT
                  geoiplongitude, geoiplatitude, geoiplocation,
                  geoipcity, geoiptime_zone, geoipcontinent_code,
                  geoipcountry_code3, geoipcountry_code2, geoipcountry_name
                  FROM local-geoips
                  WHERE :clientipnumber BETWEEN startrange AND endrange"
        parameters => {clientipnumber => "[c-ip]"}
        target => "sql_geoip"
      }
    ]
    staging_directory => "/tmp/logstash/jdbc_static/import_data"
    # run loaders every 2 hours
    loader_schedule => "* */2 * * *"
    jdbc_user => "user"
    jdbc_password => "password"
    jdbc_driver_class => "com.mysql.jdbc.Driver"
    jdbc_driver_library => "/usr/share/java/mysql-connector-java.jar"
    jdbc_connection_string => "jdbc:mysql://some-address:3306/DB"
  }

Code: Select all

:reason=>"Couldn't find any filter plugin named 'jdbc_static'. Are you sure this is correct? Trying to load the jdbc_static filter plugin resulted in this error: no such file to load -- logstash/util/loggable", :level=>:error}

Code: Select all

/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-java/lib/logstash/util/loggable.rb

Code: Select all

Pipeline aborted due to error {:exception=>"LogStash::Filters::Jdbc::ConnectionJdbcException", :error=>"Java::JavaSql::SQLException: The server time zone value 'CDT' is unrecognized or represents more than one time zone. You must configure either the server or JDBC driver (via the serverTimezone configuration property) to use a more specifc time zone value if you want to utilize time zone support."