Iptables intergrations Processors

Elastic Stack Elastic Agent
1

I wourd like to add a field when source ip is one of 192.168.100.0/24 or 172.17.100.0/24 subnet
So i added this precocessor in iptables integration field on my agnet policy but It's totaly ignored.
That's wrong with it?

  - add_fields:
      target: network
      fields:
          tag: "mylan"
      when:
        network:
           source.ip: [ "192.168.100.0/24", "172.17.100.0/24"]

Many Thanks

2

The integration doesn't parse the message until it reaches elasticsearch so there is no source.ip field yet.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.