Unable to strip IPv6 Address From Field

Elastic Stack Beats
1

I am using the below filter but it isn't working. No errors being thrown, the string just isn't being stripped.

filter {
  if "::ffff:" in [event_data.IpAddress] {
    mutate {
      id => "IPv6 Strip"
      gsub => [
        "event_data.IpAddress", "::ffff:", ""
      ]
    }
  }
}
2

Looks like Logstash, not beats related. Anyways, nested fields must be accessed using index syntax in logstash. e.g. [event_data][IpAddress].

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.