graylog2-server icon indicating copy to clipboard operation
graylog2-server copied to clipboard

cidr_match on keys of a lookup table

Open theherodied opened this issue 2 years ago • 0 comments

It would be useful to be able to perform a cidr_match on the keys of a lookup table. @brucegivens opened a request on the now archived graylog-plugin-pipeline-processor repository here:

https://github.com/Graylog2/graylog-plugin-pipeline-processor/issues/246

The goal would be to look up a specific ip and have it do a cidr_match on a lookup table.

For example:

CSV lookup table containing Amazon AWS IP ranges: "100.20.0.0/14","amazon-ip-range" "100.24.0.0/13","amazon-ip-range" "103.246.148.0/22","amazon-ip-range" "103.4.8.0/21","amazon-ip-range"

Then have the pipeline rule peform a cidr_match for an ip such as 100.20.0.1 against the lookup_table and return the value amazon-ip-range.

theherodied avatar Jan 30 '24 13:01 theherodied