How to make something like an IP address be stored in an array of integers instead of a string

Elastic Stack Logstash
1

So I want to basically do a string split at the " . " in one of my outputs from a log file (It is an IP address). Is there any way to do this with a Logstash filter? It would make the requests from my application to my server generate much less garbage when I call the server.

2

This configuration:

input { stdin {} }

filter {
  mutate { split => { "message" => "." } }
  mutate { convert => { "message" => "integer" } }
}

output { stdout { codec => rubydebug } }

Will result in this output, if fed 172.19.73.1 as STDIN:

172.19.73.1
{
    "@timestamp" => 2017-02-27T20:35:00.726Z,
      "@version" => "1",
          "host" => "REDACTED.local",
       "message" => [
        [0] 172,
        [1] 19,
        [2] 73,
        [3] 1
    ]
}
1 Like
3

That worked perfectly, thanks a lot!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.