# Mapping ip address to specific network

**URL:** <https://discuss.elastic.co/t/mapping-ip-address-to-specific-network/132268>\
**Category:** Logstash\
**Created:** [May 17, 2018, 7:30am UTC](https://discuss.elastic.co/t/mapping-ip-address-to-specific-network/132268 "2018-05-17T07:30:16Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmalewicz](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@mmalewicz](https://discuss.elastic.co/u/mmalewicz)\
**Post date:** [May 17, 2018, 7:30am UTC](https://discuss.elastic.co/t/mapping-ip-address-to-specific-network/132268/1 "2018-05-17T07:30:16Z")

</div>

Hello,

I have a problem preparing logstash script.  
I'm parsing a syslog, then I get a source IPv4 address. I would like to match this addres to a networks defined in file and add a field with network name.

example of network definition:

193.254.136.0/26; Network 1  
212.23.99.0/24; Network 2  
160.218.40.128/25; Network 3

for example when I get address 193.254.136.6 I would like to add field containing "Network 1"  
For address i.e. 212.23.99.14 I would like to have this field with "Network 2" value.

I've checked possibility of defining network as regular expression however the problem is number of entries. I have like 3k+ networks with different masks and preparing RE for each seems impossible.

Second option (also abandoned) was to expand the networks to all hosts which they contains.  
Then use translate filter plugin with dictionary\_path to file containg IPs and net name but it result in 800k+ lines dictionary 🙂  
I'm affraid of performance issues

Gone through geoip and cidr filters with no concept found (cidr seemed promising but it only gives info if ip is in range of the listed networks, without info in which one)

Any ideas?  
Thanks in advance

Michal

---

<div class="post-metadata">

**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\
**Post date:** [May 17, 2018, 7:32am UTC](https://discuss.elastic.co/t/mapping-ip-address-to-specific-network/132268/2 "2018-05-17T07:32:32Z")

</div>

logstash filter add\_field

---

<div class="post-metadata">

**Author:** ![mmalewicz](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@mmalewicz](https://discuss.elastic.co/u/mmalewicz)\
**Post date:** [May 17, 2018, 7:34am UTC](https://discuss.elastic.co/t/mapping-ip-address-to-specific-network/132268/3 "2018-05-17T07:34:49Z")

</div>

Thanks for reply  
add\_field yes but how to differentiate values depending on Ip address using this filter?

---

<div class="post-metadata">

**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\
**Post date:** [May 17, 2018, 7:43am UTC](https://discuss.elastic.co/t/mapping-ip-address-to-specific-network/132268/4 "2018-05-17T07:43:40Z")

</div>

> [@mmalewicz](#):
>
> 193.254.136.0/26; Network 1
> 
> 212.23.99.0/24; Network 2
> 
> 160.218.40.128/25; Network 3

change the 193.xx.xx/26 to two value, one is ip one is netmask if value2 = 26 add network1 filed.

---

<div class="post-metadata">

**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\
**Post date:** [May 17, 2018, 7:51am UTC](https://discuss.elastic.co/t/mapping-ip-address-to-specific-network/132268/5 "2018-05-17T07:51:12Z")

</div>

i don't remeber **if** is have include .  
if ["value"] =~ [" 193.254"] i don't know it ok or not ,include  
@mmalewicz

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 17, 2018, 8:00am UTC](https://discuss.elastic.co/t/mapping-ip-address-to-specific-network/132268/6 "2018-05-17T08:00:27Z")

</div>

It seems like the cidr filter might be the way to go as it allows you to specify and match ip range. It will however require one filter per network, and as you have a large number of them it could get slow. You may however be able divide your processing into group so that you do not have to process all combinations for every entry. It will still result in a large config, but something along these lines might work:

```auto
input {
  generator {
    lines => ['193.254.136.0','212.23.99.0','160.218.40.128']
    count => 1
  } 
} 

filter {
    dissect {
        mapping => {
            "message" => "%{ip}.%{+ip}.%{}"
      }
    }

    if [ip] == "193.254" {
        cidr {
            add_field => { "network" => "Network 1" }
            address => ["%{message}"]
            network => ["193.254.136.0/26"]
        }
        cidr {
            add_field => { "network" => "Network X" }
            address => ["%{message}"]
            network => ["193.254.1.0/26"]
        }
    } else if [ip] == "212.23" {
        cidr {
            add_field => { "network" => "Network 2" }
            address => ["%{message}"]
            network => ["212.23.99.0/24"]
        }
    } else if [ip] == "160.218" {
        cidr {
            add_field => { "network" => "Network 3" }
            address => ["%{message}"]
            network => ["160.218.40.128/25"]
        }
    }
}

output {
  stdout { codec => rubydebug }
}

```

I would also test the large expanded dictionary file for the translate plugin to see what level of performance you get, as it would result in a much more compact configuration.

---

<div class="post-metadata">

**Author:** ![mmalewicz](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@mmalewicz](https://discuss.elastic.co/u/mmalewicz)\
**Post date:** [May 17, 2018, 8:07am UTC](https://discuss.elastic.co/t/mapping-ip-address-to-specific-network/132268/7 "2018-05-17T08:07:34Z")

</div>

Thanks, I will test large dictionary perfomance as network definition may change over the time and I will just change the dictionary, not the code

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 17, 2018, 8:10am UTC](https://discuss.elastic.co/t/mapping-ip-address-to-specific-network/132268/8 "2018-05-17T08:10:11Z")

</div>

One other candidate could also be the [jdbc static filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-jdbc_static.html), based on a table with expanded IP-network mappings.

---

<div class="post-metadata">

**Author:** ![mmalewicz](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@mmalewicz](https://discuss.elastic.co/u/mmalewicz)\
**Post date:** [June 7, 2018, 12:10pm UTC](https://discuss.elastic.co/t/mapping-ip-address-to-specific-network/132268/9 "2018-06-07T12:10:52Z")

</div>

Expanded network 800k+ dictionary + translate filter plugin did the job. Thanks for all hints 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2018, 12:11pm UTC](https://discuss.elastic.co/t/mapping-ip-address-to-specific-network/132268/10 "2018-07-05T12:11:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.