# Iptables intergrations Processors

**URL:** <https://discuss.elastic.co/t/iptables-intergrations-processors/321289>\
**Category:** Elastic Agent\
**Created:** [December 15, 2022, 10:40am UTC](https://discuss.elastic.co/t/iptables-intergrations-processors/321289 "2022-12-15T10:40:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![david-a76](https://avatars.discourse-cdn.com/v4/letter/d/e480ec/32.png) [@david-a76](https://discuss.elastic.co/u/david-a76)\
**Post date:** [December 15, 2022, 10:40am UTC](https://discuss.elastic.co/t/iptables-intergrations-processors/321289/1 "2022-12-15T10:40:55Z")

</div>

I wourd like to add a field when source ip is one of 192.168.100.0/24 or 172.17.100.0/24 subnet  
So i added this precocessor in iptables integration field on my agnet policy but It's totaly ignored.  
That's wrong with it?

```auto
  - add_fields:
      target: network
      fields:
          tag: "mylan"
      when:
        network:
           source.ip: ["192.168.100.0/24", "172.17.100.0/24"] 

```

Many Thanks

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [December 30, 2022, 7:52pm UTC](https://discuss.elastic.co/t/iptables-intergrations-processors/321289/2 "2022-12-30T19:52:52Z")

</div>

The integration doesn't parse the message until it reaches elasticsearch so there is no source.ip field yet.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 27, 2023, 7:53pm UTC](https://discuss.elastic.co/t/iptables-intergrations-processors/321289/3 "2023-01-27T19:53:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.