Splitting IP addresses

[ecamero2 (Ethan Cameron)]

Good Morning,

I have a need to remove part of a field if it exists. I have a field that contains either one or two ip addresses:

ie: "1.2.3.4" OR "1.2.3.4,5.6.7.8"

I only want to retain the first address (before the comma) if there is two. This is my current config:

 if [auth_info][ipaddress] =~ "," {
    grok {
        match => { "[auth_info][ipaddress]" => "%{DATA:[auth_info][ipaddress]}," }
    }
 }

But it is never even getting through the conditional (no events are hitting the grok)

Any ideas?

[yaauie (Ry Biesemeyer)]

the right-hand side of your expression is a literal string, not a pattern; we should be more informative when encountering this, because a value will never "match" a literal string.

I believe you are looking for:

if [auth_info][ipaddress] =~ /,/ {
  # ...
}

What version of Logstash? I'd like to make sure we catch this and provide a useful error message in the future.

[yaauie (Ry Biesemeyer)]

You may also be better off performance-wise using the gsub directive of the mutate filter:

filter {
  if [auth_info][ipaddress] =~ /,/ {
    mutate {
      gsub => [
        "[auth_info][ipaddress]", ",.*$", ""
      ]
    }
  }
}