How to check if host.ip in particular CIDR


I want to add an ingest pipeline script that will add particular fields if host.ip falls into the CIDR notation range.

I was trying some stuff but still, that does not work
The script does not return errors but fields are not added.

CIDR block = new CIDR(""); # or def block = new CIDR("")
for (int i = 0; i <; ++i) {
    if (block.contains(ctx["host.ip"])) {
        ctx[""] = "Value1";
        ctx["host.bo_name"] = "Value2";

If you can spot the error and guide me It would be very helpful.

Stack is on 7.16-2

This started to work. I was not able to manage to add a field via ctx._source... I used a set before that processor instead.

CIDR block = new CIDR("");
for (int i = 0; i < ctx?.host?.ip.length; ++i) {
    if (block.contains([i])) {
        ctx?.host.bo_name = "Value";

Now I just wonder what would be the performance impact of using runtime field instead of ingest pipeline script processor.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.