CIDR,subnet relating

Hi All,

Will I be able to match my ip address to subnets ,i know we can use CIDR ,but I have around 800 subnets is there any way I can match the ip addresses with that using translate and CIDR together .

I want to match my source ip and destination ip , to the csv file which I have for 800 subnets with location details.

Any help would be appreciable and useful for me

Thank you in Advance


Any help pls :slight_smile:

I'm pretty sure you can do this very easy.
lets's say you have a subnet called Home.
You should have a field IPSource that reads the ip from the message.
then use an if in your output:

if "192.168.0.*" in [IPSource]{
subnet => "Home"

Thank you so much for the reply ,but i have 800 unique subnets with different location names, is it only way to hard code each every subnets?

If I were you I would just read both files in and then match them in elasticsearch. I think elasticsearch is beter fit to solve this problem. 25 home 25 home2 home3 home4 home5 home6

Something like this if i get a source ip in in my logs, i should get a field name called home

Any sugesstions ? :slight_smile:

I'm also a beginner I just started using ELK since 1 week so I can't just give you the answer but I can help looking :slight_smile:

This looks pretty usefull. Just take your time and look some more into elasticsearch I'm pretty sure you can find the solution in less then a day :slight_smile:

Thank you :slight_smile:

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.