Variable content from file

Elastic Stack Logstash
1

Hi.
Im using cidr filter to check if an IP si public or private.
The list of cidrs to check is now hardcoded in the filter but I need to read it from a file or using a meta-variable loaded at runtime.

cidr {
                id => "netflow-postproc-cidr-dst_addr"
                address => [ "%{[@metadata][netflow][dst_addr]}" ]
                network => [ "0.0.0.0/32", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fc00::/7", "127.0.0.0/8", "::1/128","169.254.0.0/16", "fe80::/10","224.0.0.0/4", "ff00::/8","255.255.255.255/32" ]
                add_field => { "[@metadata][netflow][dst_locality]" => "private" }
            }

Something like this:

cidr.yml => [@metadata][private_cidr]

and then

network => [@metadata][private_cidr]

Is it possible?

Thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.