Logstash filter (pipeline snippet) for google safe browsing lookup via sbserver

google-safebrowsing-sbserver.conf

### This logstash filter reads a URL/domain (can be anything from example.com to
### http://www01.users.example.com/path/to/index.xhtml) from field "message" and
### issues a lookup to google safe browsing tool sbserver (found at
### https://github.com/google/safebrowsing). On positive return (not malicious)
### the field "safe_browsing_state" is set to "harmless", otherwise to "malicious".
### To be used, sbserver has to run on localhost:8080.

input { }
filter {
  ruby {
    code => 'require "net/http"
            url = event.get("message")
            uri = URI("http://localhost:8080/r?url=" + url)
            res = Net::HTTP.get_response(uri)
            if res.is_a?(Net::HTTPSuccess)
              event.set("safe_browsing_state", "malicious")
            else
              event.set("safe_browsing_state", "harmless")
            end'
  }
}
output { }