Match a IP and add a Name

Elastic Stack Logstash
1

Hi everyone,

short question:

is it possible to match the client_Ip field against a set of ips -> names?

right now i collect my haproxy logs into ES and can see the client_IP without any problem, all IPs are whitelisted, so i need to go on my firewall and look into the list, but it would be easier for other ppl, to see the name of the Partner behind the IP.

maybe someone has an idea?

was first thinking about a script with curl to add the named for each document, but...yea could be madness :smiley: (index currently only have 3 - 4milion doc. each day)

so maybe something fancy within logstash, that i cant see?

thanks in advance for any idea and help,

Cheers
Dirk

2

If you use the translate filter you can do that during ingestion, or you could use the Elasticsearch filter to do a lookup of in an index where you may have that info and do the same thing.

3

Hi @warkolm,

things that i never heard of :smiley:
will take a look thanks.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.