# Logstash-CIDR Plugin **URL:** \ **Category:** Logstash\ **Created:** [April 8, 2022, 5:03pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990 "2022-04-08T17:03:33Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![leela](https://avatars.discourse-cdn.com/v4/letter/l/8baadc/32.png) [@leela](https://discuss.elastic.co/u/leela)\ **Post date:** [April 8, 2022, 5:03pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/1 "2022-04-08T17:03:33Z")
How can we pass multiple IP's and Location names in Logstash config file with CIDR plugin for Source and Destination ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 8, 2022, 6:24pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/2 "2022-04-08T18:24:14Z")
The [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-cidr.html#plugins-filters-cidr-address) shows examples of passing multiple entries for both the network and address options. ---
**Author:** ![leela](https://avatars.discourse-cdn.com/v4/letter/l/8baadc/32.png) [@leela](https://discuss.elastic.co/u/leela)\ **Post date:** [April 9, 2022, 5:38pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/5 "2022-04-09T17:38:04Z")
[quote="gadapa, post:4, topic:301990, full:true"] cidr { address =\> ["%{[source][ip]}", "%{[destination][ip]}" ] network =\> ["172.24.51.0/24"] add\_field =\> { "src\_location" =\> "Port-Gentil" } add\_field =\> { "des\_location" =\> "Port-Gentil" } } cidr { address =\> ["%{[source][ip]}", "%{[destination][ip]}" ] network =\> ["172.24.54.0/24"] add\_field =\> { "src\_location" =\> "Luanda-LUA" } add\_field =\> { "des\_location" =\> "Luanda-LUA" } } i am adding like this for separate source and destination ..but i there are multiple ips and location names. so how can i pass this all in cidr to get exact match for ip and location.. can you please help me on this I need same location mapping for source ip nd des ip but am unable to fetch it ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 9, 2022, 6:11pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/6 "2022-04-09T18:11:27Z")
To do this using add\_field you would actually need even more filters. One for source and one for destination, otherwise an event that had a source in one network and a destination in another would get one of them set incorrectly. For example, if the source were Port-Gentil and the destination were Luanda-LUA then the second filter would overwrite src\_location with Luanda-LUA. There are a couple of github issues that relate to this. [This issue](https://github.com/logstash-plugins/logstash-filter-cidr/issues/24) has code that would add the network that matched into the event. However, since the filter can do multiple lookups it will, I think, overwrite that field for the second lookup. [This issue](https://github.com/logstash-plugins/logstash-filter-cidr/issues/16) (and the unmerged/closed PRs it links to) discusses ways to implement this. Sadly, I do not think any of them actually work when the filter does multiple lookups. If you are OK with just looking up one IP address at a time then you could rebuild the filter from source patched with one of those PRs. ---
**Author:** ![leela](https://avatars.discourse-cdn.com/v4/letter/l/8baadc/32.png) [@leela](https://discuss.elastic.co/u/leela)\ **Post date:** [April 10, 2022, 5:56am UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/7 "2022-04-10T05:56:55Z")
address =\> ["%{[source][ip]}" ] network =\> ["10.176.0.0/16"] add\_field =\> { "source\_location" =\> "Korea-HHI-Shipyard" } } cidr { address =\> ["%{[source][ip]}" ] network =\> ["10.177.0.0/16"] add\_field =\> { "source\_location" =\> "Cairo" } } cidr { address =\> ["%{[source][ip]}" ] network =\> ["10.192.0.0/16"] add\_field =\> { "source\_location" =\> "Seven-Antares" } } cidr { address =\> ["%{[destination][ip]}" ] network =\> ["10.1.0.0/16"] add\_field =\> { "destination\_location" =\> "Aberdeen-Greenwell" } } cidr { address =\> ["%{[destination][ip]}" ] network =\> ["10.2.0.0/16"] add\_field =\> { "destination\_location" =\> "Glasgow" } } cidr { address =\> ["%{[destination][ip]}" ] network =\> ["10.4.0.0/16"] add\_field =\> { "destination\_location" =\> "Leith" } } is this will work for cidr for sourec and des as a separate? pls help me on this ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 10, 2022, 5:43pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/8 "2022-04-10T17:43:13Z")
Yes, if you use a separate filter for each network/location then that will work. ---
**Author:** ![leela](https://avatars.discourse-cdn.com/v4/letter/l/8baadc/32.png) [@leela](https://discuss.elastic.co/u/leela)\ **Post date:** [April 18, 2022, 11:49am UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/9 "2022-04-18T11:49:05Z")
Hi, if i use separate cidr for both src and des for same ip address and location as mentoned above format. still am getting an error of invalid skipping address. am unable to fetch the des location in dashboard.is there any method to add both ..kindly help me on this Invalid IP address, skipping {:address=\>"{%[destination][ip]}", :event=\>{"event"=\>{"created"=\>"2022-04-12T18:17:12.002Z", "kind"=\>"event", "module"=\>"netflow", "dataset"=\>"netflow.log", ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 19, 2022, 4:55pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/10 "2022-04-19T16:55:05Z")
If Elasticsearch is logging that then I think it is telling you that the [destination][ip] field did not exist on the original event. You could use a [prune](https://www.elastic.co/guide/en/logstash/current/plugins-filters-prune.html) filter to remove any fields where sprintf substitution did not occur. ---
**Author:** ![leela](https://avatars.discourse-cdn.com/v4/letter/l/8baadc/32.png) [@leela](https://discuss.elastic.co/u/leela)\ **Post date:** [April 19, 2022, 5:05pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/11 "2022-04-19T17:05:11Z")
can u give me syntax how to add ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 19, 2022, 5:08pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/12 "2022-04-19T17:08:52Z")
The default value for the blacklist\_names option is ["%{[^}]+}"], so you can just use ``` prune {} ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 19, 2022, 5:33pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/14 "2022-04-19T17:33:44Z")
As I said, "If Elasticsearch is logging that". But it is not, it is being logged by the [cidr filter](https://github.com/logstash-plugins/logstash-filter-cidr/blob/953efbd67aefdc38d22e74bc468e2a21c7a26a8c/lib/logstash/filters/cidr.rb#L128). You could check that the address is valid before calling the filter ``` if [source][ip] =~ /(? ["%{[source][ip]}" ] .... ``` ---
**Author:** ![leela](https://avatars.discourse-cdn.com/v4/letter/l/8baadc/32.png) [@leela](https://discuss.elastic.co/u/leela)\ **Post date:** [April 24, 2022, 4:43pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/15 "2022-04-24T16:43:53Z")
Is the ruby code will work for adding both src and des at a time in cidr?.Is address field cannot handle array input as stated in doc? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 24, 2022, 4:57pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/16 "2022-04-24T16:57:31Z")
> [@leela](#): > > Is the ruby code will work for adding both src and des at a time in cidr? It is not ruby code, it is a logstash [conditional](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals) (which uses the regexp for IPV4 from grok). You could use ``` if [source][ip] =~ /(? ["%{[source][ip]}", "%{[destination][ip]}" ] .... ``` but if either is invalid then the filter is not called and neither will get mapped. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 22, 2022, 4:58pm UTC](https://discuss.elastic.co/t/logstash-cidr-plugin/301990/17 "2022-05-22T16:58:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.