Matching ip address

[Lalii]

Hello everyone,

I'm trying to do a condition on IP regex.

Trying to match every IPs

if [destination.XXX] =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/ {
mutate {
...
}
}

I tried the solution from that post but doesnt work :

Only invoke geoip if field is IP

How do I conditionally invoke geoip if the field is a valid IP address?

Thanks for your help

[leandrojmp (Leandro Pereira)]

@Lalii

destination.XXX

What is the field name? Please share a sample of your message.

In Logstash you access nested fields using [topLevel][nestedField] not [topLevel.nestedField]

So if your field is a nested json object you need to use [destination][XXX].

[Lalii]

Thanks for your answer leandrojmp. Here is a sample :

[leandrojmp (Leandro Pereira)]

So, it worked or not?

From what you shared you have a geoip working already, it is not clear what is the issue.

[Lalii]

That actually doesn't work. I'm doing a reverse DNS request on that field but that regex doesn't match.

I would like to check if the field [destination][domain] contain an IP instead of a dns information.

Do you know why that doesn't match ?
Regards