Drop ipv6 from metricbeat data

[Adriann (Adrian)]

Hello,

I want to drop ipv6 address from metricbeat host.ip document values.

How can I do that?

I am on 7.16-2

[Andrea_Spacca]

Hello @Adriann

you could add a script processor in the ingestion pipeline:

            ArrayList ipv4 = new ArrayList();
            for (int i = 0; i < ctx.host?.ip?.length; ++i) {
              if (!ctx.host.ip[i].contains(":")) {
                  ipv4.add(ctx.host.ip[i]);
              }
            }
            ctx.host.ip = ipv4;