rubyfilter-example.conf

filter {

 if [misp][feed][domain]
 {
     ruby {
            init => "
            require 'net/http'
            require 'uri'
            require 'json'
            "
        code => "
            uri = URI.parse('https://***************/attributes/restSearch') #insert your MISP address here
            request = Net::HTTP::Post.new(uri)
            request.content_type = 'application/json'
            request['Accept'] = 'application/json'
            request['Authorization'] = '*************************' #insert your MISP API key here
            request.body = JSON.dump({
                'returnFormat' => 'json',
                'includeEventTags' => 'yes',
                'value' => event.get('[destination][domain]')
            })

        req_options = {
            use_ssl: uri.scheme == 'https',
            verify_mode: OpenSSL::SSL::VERIFY_NONE,
        }

        response = Net::HTTP.start(uri.hostname, uri.port, req_options) do |http|
            http.request(request)
        end

        if response.code == '200'
                result = JSON.parse(response.body)
            #event.set('MISP.all', result)
            mispeventinfoarr = []
            mispattributetagarr = []

            for e in result['response']['Attribute']
                for t in e['Tag']
                mispattributetagarr.push(t['name'])
                end
            mispeventinfoarr.push(e['Event']['info'])
            end
            event.set('[misp][tag]', mispattributetagarr.uniq)
            event.set('[misp][eventinfo]', mispeventinfoarr.uniq)
            end
            "
     }
 }
}