Add field depending of the dstip

[donetz]

Hi community!

I'm using logstash to process some data and I'm in trouble!! This is my situation:

• I'm reading alerts witg Filebeat from a file that has been written by a SIEM.
• I'm receiving these alerts with logstash and I want to check if "dstip" is a concrete one, and then add a field if matched.

Logstash conf:

Thanks in advance!!

[Badger]

You are trying to add a field, but you have configured a remove_field option. Plus, that takes an array, not a hash, so it ends up as a no-op.

[donetz]

What do you mean when you say that it takes an array?
I don´t know how add fields to the alert when the dtsip IP is a specific one.
This is the message I'm receiving.

[Badger]

@donetz

What do you mean when you say that it takes an array?

remove_field needs a list of fields to remove. It does not matter what the values of the fields are, so all it needs is an array of field names.

add_field needs a list of fields to add and the values that should be added. So it expects a hash.