Drop ipv6 from metricbeat data

Elastic Stack Beats
1

Hello,

I want to drop ipv6 address from metricbeat host.ip document values.

How can I do that?

I am on 7.16-2

2

Hello @Adriann

you could add a script processor in the ingestion pipeline:

            ArrayList ipv4 = new ArrayList();
            for (int i = 0; i < ctx.host?.ip?.length; ++i) {
              if (!ctx.host.ip[i].contains(":")) {
                  ipv4.add(ctx.host.ip[i]);
              }
            }
            ctx.host.ip = ipv4;
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.