I am relatively new to elastic and expanding our ES daily.
We are ingesting logs from various network devices but come across a problem in Cisco. They do not send the hostname in their syslog and therefore all we get is for example
log.source.address: 10.1.1.1:56783 (where the port is random)
Therefore in KQL there are many entries for one device and seems no way to simply wildcard 10.1.1.1.
Using Lucene we need to build a regular expression for this and tried various formats but as ^ is not supported there seems no way to say
log.source.address:10/.1/.1/.1:<1-99999> and produce a result from this or using various combinations.
Can anyone advise the best code for this ?
Thanks in advance for the advice.