Removes ::ffff: from ip address field

Elastic Stack Logstash
1

Hello,

i want to remove ::ffff: from ip address field (like this)
ip

so in logstash i've made this

# Removes ::ffff from IP address
filter {
  if "winlogbeat" in [tags] {
  mutate {
    gsub => ["[event_data][IpAddress]", "::ffff:", ""]
         }
                            }
        }

but that does not work, any ideas ?

Thx for help

Thibaut,

2

I think you need to change:

[event_data][IpAddress]

To this:

%{[event_data][IpAddress]}
3

i've changed and it's really strange sometimes i've ::ffff: and somitimes not

February 1st 2019, 12:42:33.724 ::ffff:10.100.25.108

February 1st 2019, 12:42:33.471 10.100.247.131

i think the filter doen't removes ::ffff; and certain event don't have this ffff.

it's possible ?

4

The addresses with ::ffff: are mapped ipv6 addresses.

have read here

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.