Contents

# encoding: UTF-8
require 'json'

class Fluent::ModsecurityFilter < Fluent::Filter

    Fluent::Plugin.register_filter('modsecurity', self)

    desc "Path prefix of the detail log"
    config_param :path_prefix, :string, default: "/var/log"

    def configure(conf)
        super
        @path_prefix = conf['path_prefix']
    end

    def filter(tag, time, record)
        log_path = ""
        record.each{ |key, value|
            token = value.split(" ")
            token.each { |v|
                if v.start_with?(@path_prefix)
                    log_path = v
                    break
                end
            }
        }
        #find detail log and append to record
        unless log_path.to_s.strip.empty?
            file = File.read(log_path)
            data_hash = JSON.parse(file)
            #copy transaction object to original record
            record['transaction'] = data_hash['transaction']
        end
        record
    end
end

Version data entries

2 entries across 2 versions & 1 rubygems

Version	Path
fluent-plugin-modsecurity-0.1.3	lib/fluent/plugin/filter_modsecurity.rb
fluent-plugin-modsecurity-0.1.2	lib/fluent/plugin/filter_modsecurity.rb