Get first two octets of IP address

[Leo_Kwok]

Hi,

I only need the first two octet of IP address, for example, only 91.255 for IP 91.225.201.1. Please advise how to get this in logstash filter.

Thanks,
Leo

[Badger]

You could do it using dissect

dissect { mapping => { "someField" => "%{IP}.%{+IP}.%{}" } }