Get first two octets of IP address


I only need the first two octet of IP address, for example, only 91.255 for IP Please advise how to get this in logstash filter.


You could do it using dissect

dissect { mapping => { "someField" => "%{IP}.%{+IP}.%{}" } }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.