Logstash - IP range to CIDR

Elastic Stack Logstash
1

Hello Logstash Community,

I have parsed a set of IOC which is continuously pulled from TCP port. I have a field called @indicator which has IP values in range format (though it is a single IP value).
for example my field is available as 96.70.80.177-96.70.80.177
is there a way to convert this range type into individual CIDR format using from logstash filters ? or how to edit a original parsed field into different format as we want ?

kindly help me with troubleshooting this.

input {
 tcp {
  port => 5514
  }
}
filter {
  # Tag minemeld events
  if "@origin" in [message] {
    mutate {
      add_tag => "minemeld"
    }
    json {
      source => "message"
    }
  }
}
output {
  elasticsearch {
    hosts => "http://192.168.56.10:9200"
    index => "threat-intel-%{+YYYY.MM.dd}"
    cacert => "/etc/nginx/minemeld.cer"
  }
}

image

2

Exactly what do you want the final event to look like?

3

Thanks Badger for looking into it.

Indicator field is in range form currently as in my screenshot image above.

I want to have it as single IP only. Not as range format.

Regards,

Haran

4 
dissect { mapping => { "@indicator" => "%{ip}-%{}" } }
5

Thank you so much for the help @Badger . Unfortunately dissect is not trimming the IP in @indicator field.

Below is my new conf file. kindly let me know if I am missing something. I used "IPV4" value which is parsing in a field called type as a if condition for dissect.

input {
 tcp {
  port => 5514
  }
}
filter {
  # Tag minemeld events
  if "@origin" in [message] {
    mutate {
      add_tag => "minemeld"
    }
    json {
      source => "message"
    }
 }
  #dissecting IPV4 into CIDR format
  if "IPv4" in [type] {
    dissect {
      mapping => { "@indicator" => "%{ip}-%{}" }
    }
  }
}
output {
  elasticsearch {
    hosts => "http://192.168.56.10:9200"
    index => "logstash-threatintel-%{+YYYY.MM.dd}"
 }
}

Screenshot of new log after new conf file.

image
image.png649×797 38.5 KB

6

OK, so it parsed the ip address into the field ip. That's what you wanted, right?

7

No No. Sorry if my explanation/requirement was not clear.

I have two fields parsing by default.
field:value
type:IPV4
@indicator:196.52.43.112-196.52.43.255

my requirement is @indicator field should have only 192.52.43.112

so i used dissect mapping as you suggested with if "IPV4" in [type] as if condition

if "IPv4" in [type] {
    dissect {
      mapping => { "@indicator" => "%{ip}-%{}" }
  }
}
8

If you want to overwrite the field then you can do that

dissect { mapping => { "@indicator" => "%{@indicator}-%{}" } }
9

Awesom. Thanks @Badger . It did the magic. I was able to trim the @indicator field from range to single CIDR format.

image

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.