Possible to use external file as part of filter?

Elastic Stack Logstash
1

6.3.0

I've got certain tags being applied if the message body has certain IP Addresses in it. is it possible to maintain that separate IP address (or username) list in a separate file that the filter can look at along with other filtering actions? my reasoning is it would be easier to maintain a separate file as ip/username changes over time than muck about the regular config file.

2

You could use a translate filter to tag the events.

3

that would work, not 100% but better than editing the conf files each time.

4

I have to revise my answer. Initially I was just looking for a shoot-n-go solution but the translate filter ended up really being just what I needed. thanks!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.