# Logstash - IP range to CIDR **URL:** \ **Category:** Logstash\ **Created:** [April 7, 2019, 8:32am UTC](https://discuss.elastic.co/t/logstash-ip-range-to-cidr/175706 "2019-04-07T08:32:44Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![HaranKumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harankumar/32/87594_2.png) [@HaranKumar](https://discuss.elastic.co/u/HaranKumar)\ **Post date:** [April 7, 2019, 8:32am UTC](https://discuss.elastic.co/t/logstash-ip-range-to-cidr/175706/1 "2019-04-07T08:32:44Z")
Hello Logstash Community, I have parsed a set of IOC which is continuously pulled from TCP port. I have a field called @indicator which has IP values in range format (though it is a single IP value). for example my field is available as **96.70.80.177-96.70.80.177** is there a way to convert this range type into individual CIDR format using from logstash filters ? or how to edit a original parsed field into different format as we want ? kindly help me with troubleshooting this. ``` input { tcp { port => 5514 } } filter { # Tag minemeld events if "@origin" in [message] { mutate { add_tag => "minemeld" } json { source => "message" } } } output { elasticsearch { hosts => "http://192.168.56.10:9200" index => "threat-intel-%{+YYYY.MM.dd}" cacert => "/etc/nginx/minemeld.cer" } } ``` ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c90efa01d33624bab546c9375cd4633ca1254edd.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 7, 2019, 2:56pm UTC](https://discuss.elastic.co/t/logstash-ip-range-to-cidr/175706/2 "2019-04-07T14:56:54Z")
Exactly what do you want the final event to look like? ---
**Author:** ![HaranKumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harankumar/32/87594_2.png) [@HaranKumar](https://discuss.elastic.co/u/HaranKumar)\ **Post date:** [April 7, 2019, 3:53pm UTC](https://discuss.elastic.co/t/logstash-ip-range-to-cidr/175706/3 "2019-04-07T15:53:10Z")
Thanks Badger for looking into it. Indicator field is in range form currently as in my screenshot image above. I want to have it as single IP only. Not as range format. Regards, Haran ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 7, 2019, 4:03pm UTC](https://discuss.elastic.co/t/logstash-ip-range-to-cidr/175706/4 "2019-04-07T16:03:17Z")
``` dissect { mapping => { "@indicator" => "%{ip}-%{}" } } ``` ---
**Author:** ![HaranKumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harankumar/32/87594_2.png) [@HaranKumar](https://discuss.elastic.co/u/HaranKumar)\ **Post date:** [April 8, 2019, 11:42am UTC](https://discuss.elastic.co/t/logstash-ip-range-to-cidr/175706/5 "2019-04-08T11:42:22Z")
Thank you so much for the help @Badger . Unfortunately dissect is not trimming the IP in @indicator field. Below is my new conf file. kindly let me know if I am missing something. I used "IPV4" value which is parsing in a field called type as a if condition for dissect. ``` input { tcp { port => 5514 } } filter { # Tag minemeld events if "@origin" in [message] { mutate { add_tag => "minemeld" } json { source => "message" } } #dissecting IPV4 into CIDR format if "IPv4" in [type] { dissect { mapping => { "@indicator" => "%{ip}-%{}" } } } } output { elasticsearch { hosts => "http://192.168.56.10:9200" index => "logstash-threatintel-%{+YYYY.MM.dd}" } } ``` Screenshot of new log after new conf file. ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/7/c73eecdfdbaf146808a08c5f2b36de8cfcb474a8.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 8, 2019, 12:07pm UTC](https://discuss.elastic.co/t/logstash-ip-range-to-cidr/175706/6 "2019-04-08T12:07:14Z")
OK, so it parsed the ip address into the field ip. That's what you wanted, right? ---
**Author:** ![HaranKumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harankumar/32/87594_2.png) [@HaranKumar](https://discuss.elastic.co/u/HaranKumar)\ **Post date:** [April 8, 2019, 1:17pm UTC](https://discuss.elastic.co/t/logstash-ip-range-to-cidr/175706/7 "2019-04-08T13:17:38Z")
No No. Sorry if my explanation/requirement was not clear. I have two fields parsing by default. field:value type:IPV4 @indicator:196.52.43.112-196.52.43.255 my requirement is @indicator field should have only 192.52.43.112 so i used dissect mapping as you suggested with if "IPV4" in [type] as if condition ``` if "IPv4" in [type] { dissect { mapping => { "@indicator" => "%{ip}-%{}" } } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 8, 2019, 1:31pm UTC](https://discuss.elastic.co/t/logstash-ip-range-to-cidr/175706/8 "2019-04-08T13:31:44Z")
If you want to overwrite the field then you can do that ``` dissect { mapping => { "@indicator" => "%{@indicator}-%{}" } } ``` ---
**Author:** ![HaranKumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harankumar/32/87594_2.png) [@HaranKumar](https://discuss.elastic.co/u/HaranKumar)\ **Post date:** [April 8, 2019, 2:19pm UTC](https://discuss.elastic.co/t/logstash-ip-range-to-cidr/175706/9 "2019-04-08T14:19:36Z")
Awesom. Thanks @Badger . It did the magic. I was able to trim the @indicator field from range to single CIDR format. ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/d/ad945bd3fcdb1d541ad444638232f7774b7d19ff.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 6, 2019, 2:19pm UTC](https://discuss.elastic.co/t/logstash-ip-range-to-cidr/175706/10 "2019-05-06T14:19:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.