Cidr filter for over 1000 subnets

I have round about 1500 subnets, with masks from /18 to /29, but mainly /24 networks.
I tried to use the cidr logstash filter plugin but the pipeline then come not up. i think because the pipeline is too big and there are too many checks.

How to archive the target?
I want to add a field with cidr notation from a source.ip field.

I know there is an network. If a see Traffic from a field should be added with content "".

Anyone have a solution for this?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.