How to remove ipv6 from host.ip

Elastic Stack Beats
1

background:
winlogbeat7.3.2
windows2016
winlogbeat.yml:

processors:

  - add_host_metadata:
      netinfo.enabled: true

requirement:
in kibana:

image
image884×87 17.5 KB

I want to remove this ipv6 info ,How? THANKS!

I try to remove ipv6 info with script :slight_smile:

  - script:
      lang: javascript
      id: my_filter
      source: >
        function process(event) {
            var message = event.Get("host.ip")
            event.Put("len",message.length)
            for (var i=0; i<message.length; i++)
            {
                if (message[i].indexOf("192.") > -1)
                {
                    event.Put("host.ip",message[i])
                    break;
                }
            }
        }

but recevie:

image
image1105×348 5.86 KB

2

I could not reproduce the panic on the latest version. Please try a newer release.

3 
function process(event) {
            var message = event.Get("host.ip")
            event.Put("len",message.length)
            for (var i=0; i<message.length; i++)
            {
                if (message[i].indexOf("192.") > -1)
                {
                    event.Put("host.ip",message[i])
                    break;
                }
            }
        }

Is there any problem with the code?

1 Like
4

That code works. Of course there are other ways to implement this, but it puts the first 192 address into host.ip and returns.

5

what is other ways?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.