# How can I pass a filebeat \[host\]\[ip\] array to the logstash CIDR filter plugin?

**URL:** <https://discuss.elastic.co/t/how-can-i-pass-a-filebeat-host-ip-array-to-the-logstash-cidr-filter-plugin/171816>\
**Category:** Logstash\
**Created:** [March 11, 2019, 5:08pm UTC](https://discuss.elastic.co/t/how-can-i-pass-a-filebeat-host-ip-array-to-the-logstash-cidr-filter-plugin/171816 "2019-03-11T17:08:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![PSM](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@PSM](https://discuss.elastic.co/u/PSM)\
**Post date:** [March 11, 2019, 5:08pm UTC](https://discuss.elastic.co/t/how-can-i-pass-a-filebeat-host-ip-array-to-the-logstash-cidr-filter-plugin/171816/1 "2019-03-11T17:08:57Z")

</div>

I'm using the filebeat add\_host\_metadata processor to enrich events with an array of local IP addresses for a host but I can't pass that to the logstash CIDR filter plugin because it sees it as a string, not as an array of strings.

Filebeat add host metadata: [https://www.elastic.co/guide/en/beats/filebeat/master/add-host-metadata.html](https://www.elastic.co/guide/en/beats/filebeat/master/add-host-metadata.html)

Logstash CIDR Filter Plugin:  
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-cidr.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-cidr.html)

FILEBEAT CONFIGURATION

```
processors:
- add_host_metadata:
    netinfo.enabled: true

```

Filebeat passes the following to logstash

```
"host": {
      "ip": [
        "fe80::xxxx:xxxx:xxxx:xxx",
        "10.x.x.x",
        "fe80::xxxx:xxxx:xxxx:xxx",
        "10.x.x.x"
      ],
      "name": "HOSTNAME"
    },

```

I want to pass the [host][ip] array to the logstash CIDR filter plugin below.  
LOGSTASH CONFIGURATION

```
input {
  beats { 
    port => 5044
  }
}
filter {
    cidr {
      add_field => { "[corp][environment]" => "prod.corp.com" }
      address => "%{[host][ip]}"
      network => ["10.x.0.0/16"]
    }
}

```

However, when I do, I get the following error because the array isn't getting passed as an array:

```
[WARN][logstash.filters.cidr] Invalid IP address, skipping {:address=>"%{[host][ip]}", :event=>#<LogStash::Event:0x61279c17>}

```

It does work if I pass each individually but that is extremely messy as I don't know how many values there are for each device:

```
input {
  beats { 
    port => 5044
  }
}
cidr {
  add_field => { "[corp][environment]" => "prod.corp.com" }
  address => ["%{[host][ip][0]}", "%{[host][ip][1]}","%{[host][ip][2]}","%{[host][ip][3]}","%{[host][ip][4]}"]
  network => ["10.x.0.0/16"]
}

```

}

This works but is messy

```
[DEBUG][logstash.filters.cidr] Checking IP inclusion {:address=>#<IPAddr: IPv6:fe80:0000:0000:0000:xxxx:xxxx:xxxx:xxxx/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff>, :network=>#<IPAddr: IPv4:10.x.x.0/255.255.0.0>}
[DEBUG][logstash.filters.cidr] Checking IP inclusion {:address=>#<IPAddr: IPv4:10.x.x.x/255.255.255.255>, :network=>#<IPAddr: IPv4:10.x.0.0/255.255.0.0>}
[DEBUG][logstash.filters.cidr] Checking IP inclusion {:address=>#<IPAddr: IPv6:fe80:0000:0000:0000:xxxx:xxxx:xxxx:xxxx/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff>, :network=>#<IPAddr: IPv4:10.x.x.0/255.255.0.0>}
[DEBUG][logstash.filters.cidr] Checking IP inclusion {:address=>#<IPAddr: IPv4:10.x.x.x/255.255.255.255>, :network=>#<IPAddr: IPv4:10.x.0.0/255.255.0.0>}
[WARN][logstash.filters.cidr] Invalid IP address, skipping {:address=>"%{[host][ip][4]}", :event=>#<LogStash::Event:0x78d60b5f>}

```

Is this a general logstash issue or is this a bug with the CIDR filter plugin?

Thanks!

Peter

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 12, 2019, 12:40am UTC](https://discuss.elastic.co/t/how-can-i-pass-a-filebeat-host-ip-array-to-the-logstash-cidr-filter-plugin/171816/2 "2019-03-12T00:40:04Z")

</div>

The CIDR filter plugin appears to not be designed to work with fields that contain array values, because it uses an array of sprintf templates for its input.

I've filed an issue on the project repository: [https://github.com/logstash-plugins/logstash-filter-cidr/issues/19](https://github.com/logstash-plugins/logstash-filter-cidr/issues/19)

---

<div class="post-metadata">

**Author:** ![PSM](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@PSM](https://discuss.elastic.co/u/PSM)\
**Post date:** [March 12, 2019, 11:48am UTC](https://discuss.elastic.co/t/how-can-i-pass-a-filebeat-host-ip-array-to-the-logstash-cidr-filter-plugin/171816/3 "2019-03-12T11:48:38Z")

</div>

Thanks very much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 9, 2019, 11:48am UTC](https://discuss.elastic.co/t/how-can-i-pass-a-filebeat-host-ip-array-to-the-logstash-cidr-filter-plugin/171816/4 "2019-04-09T11:48:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.