(solved) IP anonymization (hasing) in Ingest Pipeline

Elastic Stack Kibana
1

Hi community,

I'm wondering what are the possibilities of IP anonymization with Ingest Pipeline in Kibana? I'm asking because for my use case I should be able to anonymize IP address and be able to decrypt it with special key at later point if needed. So, I need a way to hash the IP and be able to decrypt it later. Is this something we can do natively in Kibana?

In logstash you have the Fingerprint filter Plugin :

If set to IPV4_NETWORK the input data needs to be a IPv4 address and the hash value will be the masked-out address using the number of bits specified in the key option. For example, with "1.2.3.4" as the input and key set to 16, the hash becomes "1.2.0.0".

2

No, this is not possible, you can create a hash using an ingest pipeline, but you cannot decrypt it once ingested.

3

Many thanks for the quick reply. I guess I have to look for another solution where the content is hashed at ingest time (before forwarded to ES).