Filtering on external syslog message.keyword for SRC=aaa.bbb.ccc.ddd IP address

Elastic Observability
4

Here are a few message examples. I would like to filter on SRC=, SPT=, DPT=:

|Nov 6, 2021 @ 04:11:49.264|Nov 6 03:11:45 OUTER-ROUTER kernel: DROP IN=eth0 OUT= MAC=00:00:00:00:00 SRC=89.248.165.203 DST=aaa.bbb.ccc.ddd LEN=40 TOS=0x00 PREC=0x00 TTL=236 ID=9500 PROTO=TCP SPT=46285 DPT=10030 SEQ=2913663473 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 |

|Nov 6, 2021 @ 04:11:42.262|Nov 6 03:11:41 OUTER-ROUTER kernel: DROP IN=eth0 OUT= MAC=00:00:00:00:00 SRC=89.248.165.53 DST=aaa.bbb.ccc.ddd LEN=40 TOS=0x00 PREC=0x00 TTL=236 ID=32581 PROTO=TCP SPT=44022 DPT=3539 SEQ=433883477 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 |

Nov 6, 2021 @ 04:11:41.261|Nov 6 03:11:40 OUTER-ROUTER kernel: DROP IN=eth0 OUT= MAC=00:00:00:00:00 SRC=185.156.73.60 DST=aaa.bbb.ccc.ddd LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=35192 PROTO=TCP SPT=48759 DPT=50541 SEQ=2162472918 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=|

|Nov 6, 2021 @ 04:11:41.261|Nov 6 03:11:40 OUTER-ROUTER kernel: DROP IN=eth0 OUT= MAC=00:00:00:00:00 SRC=185.156.73.60 DST=aaa.bbb.ccc.ddd LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=33070 PROTO=TCP SPT=48759 DPT=41132 SEQ=1411045953 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 |