I am currently ingesting Apache logs through Filebeat via Logstash into ElasticSearch to create a data table in Kibana to display a list of all IP addresses which are trying to hit a certain resource.
Eg. in the apache access log, show how many times a client ip has requested '/images'.
At the moment, I have this working via a filter on the request field and the table appears as:
IP address, Count
As we have multiple sites hitting our Apache server though, it is possible to group the IP addresses and label them as a site name?
Eg. 10.10.10.1 and 10.10.11.2 = site 1
220.127.116.11 and 18.104.22.168 = site 2
So I could create a table like:
Site Name, Count
Site 1, 30000
Site 2, 16732