Convert IP string to Integer

[rojin]

Hi!, Is there a way to convert an IP address to an integer in logstash filters?
Suppose I have the grok pattern:

%{IPv4: clientip} - %{DATA:name}....

I want to have the equivalent byte-like integer of the IP address to be able to use JDBC query to fetch something from my MySQL table. I want to compare this integer with 2 columns and check if the IP is in the range of those values.
Is that possible?

[AquaX (Andreas Helmer)]

If you want to pick apart an IP address then create another grok pattern for that field.

grok {
match => { "clientip" => "%{INT:octet1}\.%{INT:octet2}\.%{INT:octet3}\.%{INT:octet4}"
}

{
  "octet1": [
    [
      "192"
    ]
  ],
  "octet2": [
    [
      "168"
    ]
  ],
  "octet3": [
    [
      "1"
    ]
  ],
  "octet4": [
    [
      "1"
    ]
  ]
}

You may need to then use a mutate filter to convert those fields into integers.

[rojin]

Actually, I needed the whole integer value by using the formula; For instance (192 * 256^3 + 168 * 256^2 + ...) But thanks for the reply anyway

[AquaX (Andreas Helmer)]

Ok! That’s easy to do with a ruby script once you’ve picked the numbers apart.