Drop ipv6 from metricbeat data


I want to drop ipv6 address from metricbeat host.ip document values.

How can I do that?

I am on 7.16-2

Hello @Adriann

you could add a script processor in the ingestion pipeline:

            ArrayList ipv4 = new ArrayList();
            for (int i = 0; i < ctx.host?.ip?.length; ++i) {
              if (!ctx.host.ip[i].contains(":")) {
            ctx.host.ip = ipv4;

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.