How to do lookup based on Ip ranges

Elastic Stack Logstash
1

Hi Team,

I have requirement where I have to do lookup on ranges like,
If Ip
10.10.x.xx to 10.10x.xxx matches then add fileds Firewall
10.12.xx.xx to 10.12.x.xxx matches then add fileds Application.

Below is my logstash lookupcode without ranges.

elasticsearch {
hosts => ["http://localhost:9200"]
index => ["iplist"]
query_template => "C:/Users/xyz/Desktop/elk/ip.json"      
fields => { "Application_name" => "Application_name" }
}

{ 
 "size": 1,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "IP": "%{[Source_Network_Address]}"
          }
        }
      ]
    }
  }
}

Kindly help,

Regards,
Tahseen

2

Hi,

I have got a solution by my self using the cidr filter plugin in logstash.

Cidr Filter Plugin

Regards,
Tahseen

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.