search

logstash-plugins / logstash-filter-translate

Translate filter for Logstash
Apache License 2.0
21 stars 47 forks source link

Feature request: ability to interpret lookup string as subnet #59

Open geertn444 opened 6 years ago

geertn444 commented 6 years ago

Expand the functionality by not just matching on the lookup field:

"1.1.1.1"

but have the ability to define the lookup dictionary as "subnets" and interprete them likewise. Then do subnets lookups instead of simple matches:

"1.0.0.0/24":"D"

ie source field of "1.1.1.1", "1.1.1.2" etc will all match the lookup entry and return "D". As usual in networking, the highest specific match should be returned: "1.0.0.0/8":"A" "1.1.1.0/24":"B"

1.1.1.1 should return B Matches can be done lighning fast by binary AND masking of ip and mask and compare that to subnet.

lisaens commented 4 years ago

My group would like to have this too.