I have a problem preparing logstash script.
I'm parsing a syslog, then I get a source IPv4 address. I would like to match this addres to a networks defined in file and add a field with network name.
example of network definition:
220.127.116.11/26; Network 1
18.104.22.168/24; Network 2
22.214.171.124/25; Network 3
for example when I get address 126.96.36.199 I would like to add field containing "Network 1"
For address i.e. 188.8.131.52 I would like to have this field with "Network 2" value.
I've checked possibility of defining network as regular expression however the problem is number of entries. I have like 3k+ networks with different masks and preparing RE for each seems impossible.
Second option (also abandoned) was to expand the networks to all hosts which they contains.
Then use translate filter plugin with dictionary_path to file containg IPs and net name but it result in 800k+ lines dictionary
I'm affraid of performance issues
Gone through geoip and cidr filters with no concept found (cidr seemed promising but it only gives info if ip is in range of the listed networks, without info in which one)
Thanks in advance