lib/logstash/filters/whois.rb
def register
    require "whois"
    require "timeout"
    # Add instance variables 
  end
# Setting the config_name here is required. This is how you
# configure this filter from your Logstash config.
#
# The filter will add fields prefixed with the value(s) you 
# specify below. IT WILL OVERWRITE THE FIELD IF IT ALREADY
# EXISTS.
#
# In the example below, the filter would lookup the domain 
# in a field named 'domain_or_ip01' and then create fields like
# 'domain_or_ip01_created_epoch', etc.
#
# An optional parameter will specify which fields you would like
# from the whois data. By default, the plugin will add the created
# date and the updated date.
#
# The full list of available fields:
# disclaimer | String / Nil 
# domain | String / Nil 
# domain_id | String / Nil 
# status | String / Nil 
# registered? | Boolean 
# available? | Boolean 
# created_on | Time / Nil 
# diff between created_on and now
# updated_on | Time / Nil 
# diff between updated_on and now
# expires_on | Time / Nil 
# diff between expires_on and now
# registrar | Whois::Record::Registrar / Nil 
# registrant_contacts | Array<Whois::Record::Contact> (only email)
# admin_contacts | Array<Whois::Record::Contact> (only email)
# technical_contacts | Array<Whois::Record::Contact> (only email)
# nameservers | Array<Whois::Record::Nameserver> (only email)
#
# Example config:
# [source,ruby]
#     filter {
#       whois {
#         lookup_fields => [ "domain_or_ip01", "ip_or_domain02" ],
#         # OPTIONAL parameter specifying that we want the created_on,
#         # updated_on, and expires_on fields
#         field_selection => "00000010101000000"
#         # OPTIONAL parameter specifying which percentage of records
#         # should be processed, default is 100%
#         sample = "90"
#       }
#     }
Setting the config_name here is required. This is how you
configure this filter from your Logstash config.

The filter will add fields prefixed with the value(s) you
specify below. IT WILL OVERWRITE THE FIELD IF IT ALREADY
EXISTS.

In the example below, the filter would lookup the domain
in a field named 'domain_or_ip01' and then create fields like
'domain_or_ip01_created_epoch', etc.

An optional parameter will specify which fields you would like
from the whois data. By default, the plugin will add the created
date and the updated date.

The full list of available fields:
disclaimer | String / Nil
domain | String / Nil
domain_id | String / Nil
status | String / Nil
registered. | Boolean
available.


Setting the config_name here is required . This is how you configure this filter from your Logstash config . The filter will add fields prefixed with the value ( s ) you specify below . IT WILL OVERWRITE THE FIELD IF IT ALREADY EXISTS . In the example below the filter would lookup the domain in a field named ' domain_or_ip01 ' and then create fields like ' domain_or_ip01_created_epoch ' etc . An optional parameter will specify which fields you would like from the whois data . By default the plugin will add the created date and the updated date . The full list of available fields : disclaimer | String / Nil domain | String / Nil domain_id | String / Nil status | String / Nil registered . | Boolean available .
def register
    require "whois"
    require "timeout"
  end
def register require "whois" require "timeout" end
Setting the config_name here is required.
Setting the config_name here is required .
# Add instance variables 