Enrichment via Elasticsearch Lookup

I tried to enrich alerting information with data from a logindex.

In Logstash I configured the following as a filter:

  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "logfile"
    query => "Hostname:%{test_host} and ClientIP:"    
    fields => { "Hostname" => "lookedupHostname" }
    result_size => 1
    enable_sort => false

When I tried the Query in Kibana Discover I got the expected results, but the enrichment plugin fails to lookup information based on the query. It appears to struggle with the cidr notation for some reason.

When I remove the ClientIP part from the query it successfully resolves the lookup. The result here looks different than I would expect. The variable "test_host" and the value in the created lookup "lookedupHostname" would be the same, since I specified to store the lookedup field, but they are different.

Any ideas what the issues are and how to resolve them?
Thank you in advance.

It appears that the query does not matter. No matter what parameter I use for the lookup, it always returns the same result.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.