Iptables intergrations Processors

I wourd like to add a field when source ip is one of or subnet
So i added this precocessor in iptables integration field on my agnet policy but It's totaly ignored.
That's wrong with it?

  - add_fields:
      target: network
          tag: "mylan"
           source.ip: [ "", ""] 

Many Thanks

The integration doesn't parse the message until it reaches elasticsearch so there is no source.ip field yet.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.