Class: LogStash::Filters::DNS
- Inherits:
-
Base
- Object
- Base
- LogStash::Filters::DNS
- Defined in:
- lib/logstash/filters/dns.rb
Overview
The DNS filter performs a lookup (either an A record/CNAME record lookup or a reverse lookup at the PTR record) on records specified under the ‘reverse` arrays or respectively under the `resolve` arrays.
The config should look like this:
- source,ruby
-
filter {
dns { reverse => [ "source_host", "field_with_address" ] resolve => [ "field_with_fqdn" ] action => "replace" }
}
This filter, like all filters, only processes 1 event at a time, so the use of this plugin can significantly slow down your pipeline’s throughput if you have a high latency network. By way of example, if each DNS lookup takes 2 milliseconds, the maximum throughput you can achieve with a single filter worker is 500 events per second (1000 milliseconds / 2 milliseconds).
Instance Attribute Summary collapse
-
#failed_cache ⇒ Object
readonly
Returns the value of attribute failed_cache.
-
#hit_cache ⇒ Object
readonly
Returns the value of attribute hit_cache.
Instance Method Summary collapse
Instance Attribute Details
#failed_cache ⇒ Object (readonly)
Returns the value of attribute failed_cache.
90 91 92 |
# File 'lib/logstash/filters/dns.rb', line 90 def failed_cache @failed_cache end |
#hit_cache ⇒ Object (readonly)
Returns the value of attribute hit_cache.
89 90 91 |
# File 'lib/logstash/filters/dns.rb', line 89 def hit_cache @hit_cache end |
Instance Method Details
#filter(event) ⇒ Object
112 113 114 115 116 117 118 119 120 121 122 |
# File 'lib/logstash/filters/dns.rb', line 112 def filter(event) if @resolve return if resolve(event).nil? end if @reverse return if reverse(event).nil? end filter_matched(event) end |
#register ⇒ Object
93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 |
# File 'lib/logstash/filters/dns.rb', line 93 def register if @nameserver.nil? && @hostsfile.nil? @resolv = Resolv.new(default_resolvers) else @resolv = Resolv.new(build_resolvers) end if @hit_cache_size > 0 @hit_cache = LruRedux::TTL::ThreadSafeCache.new(@hit_cache_size, @hit_cache_ttl) end if @failed_cache_size > 0 @failed_cache = LruRedux::TTL::ThreadSafeCache.new(@failed_cache_size, @failed_cache_ttl) end @ip_validator = Resolv::AddressRegex end |