How to do lookup based on Ip ranges

Hi Team,

I have requirement where I have to do lookup on ranges like,
If Ip
10.10.x.xx to 10.10x.xxx matches then add fileds Firewall
10.12.xx.xx to 10.12.x.xxx matches then add fileds Application.

Below is my logstash lookupcode without ranges.

elasticsearch {
hosts => ["http://localhost:9200"]
index => ["iplist"]
query_template => "C:/Users/xyz/Desktop/elk/ip.json"      
fields => { "Application_name" => "Application_name" }
}
{ 
 "size": 1,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "IP": "%{[Source_Network_Address]}"
          }
        }
      ]
    }
  }
}

Kindly help,

Regards,
Tahseen

Hi,

I have got a solution by my self using the cidr filter plugin in logstash.

Cidr Filter Plugin

Regards,
Tahseen

1 Like