LogStash

Question

我正在使用 cidr 过滤器来检查 IP si public 还是私有 IP。要检查的 cidr 列表现在已硬编码在过滤器中，但我需要从文件中读取它或使用在运行时加载的元变量。

cidr {
                id => "netflow-postproc-cidr-dst_addr"
                address => [ "%{[@metadata][netflow][dst_addr]}" ]
                network => [ "0.0.0.0/32", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fc00::/7", "127.0.0.0/8", "::1/128","169.254.0.0/16", "fe80::/10","224.0.0.0/4", "ff00::/8","255.255.255.255/32" ]
                add_field => { "[@metadata][netflow][dst_locality]" => "private" }
            }

像这样：

cidr.yml => [@metadata][private_cidr]

然后

...
network => [@metadata][private_cidr]
...

可能吗？

谢谢

Answer 1

您可以使用 network_path 设置代替 network:

        cidr {
            id => "netflow-postproc-cidr-dst_addr"
            address => [ "%{[@metadata][netflow][dst_addr]}" ]
            network_path => "/path/to/cidr.yml"
            add_field => { "[@metadata][netflow][dst_locality]" => "private" }
        }

LogStash - 从文件中读取字段内容

LogStash - Read field content from file

elasticsearch