Cidr plugin - array fields for address input

Elastic Stack Logstash
1

Hi,
I am testing to enrich logs based on host-metadata from filebeat agent (v. 7.7.0).
Logstash version in this test env. is 7.7.0 and cidr plugin version is 3.1.3.
Although array field support for address input is added to cidr plugin in v. 3.1.3 as https://github.com/logstash-plugins/logstash-filter-cidr/issues/19 issue is closed, logstash/cidr still fails with Invalid IP address, skipping {:address=>"%{[host][ip]}.

I am aware of using address => [ "%{[host][ip][0]}" , "%{[host][ip][1]}", ... ] as a workaround but it is messy.

Has anyone experienced this issue and have a solution for this?

Logstash configuration file:

input { 
  beats {
    port => 5044
    host => "127.0.0.1"
    ssl => false
  }
}
filter {
     cidr {
        add_tag => [ "privat-nett" ]
        address => [ "%{[host][ip]}" ]
        network => [ "10.0.2.0/24" ]
     }
}
output {
  file {
   path => "/var/log/logstash/test.log"
  }
}
2

The PR adds support for arrays in the network option, not in the address option. It is unclear to me that issue 19 should have been closed.

3

Hi,
According to cidr plugin documentation both network and address field already supports array inputs. This PR only fixes network field. Apparently, address field cannot handle array input as stated in doc.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.