We have many network appliances that send syslog to Logstash. We'd like to add a tag describing the appliance's subnet name or other string concerning the source appliance. Is there a way to do that?
https://www.elastic.co/guide/en/logstash/current/plugins-filters-cidr.html, but it will hurt your Logstash throughput.
Thanks for your advice. I'll try that.