I'm using logstash as output method for packetbeat and I want to filter transactions in logstash, for example, I received 3 packets described as below
packet A is from 192.168.0.3 to 192.168.0.4
packet B is from 192.168.0.3 to 192.168.0.5
packet C is from 192.168.0.3 to 10.0.168.9
now I need logstash only output packet C, what i'm thinking now is to maintain a whitelist read from some config file in logstash, any packet compliant with this list will output and others won't.
Does logstash have this kind of feature ? or any workaround I can take ?
thanks a lot !