zeek dns.resolved_ip

2025-12-24 01:43:11 +01:00 · 2025-08-19 11:20:59 -05:00
parent 6fae4a9974
commit 95bee91b12
2 changed files with 25 additions and 1 deletions
--- a/salt/elasticsearch/files/ingest/common.ip_validation
+++ b/salt/elasticsearch/files/ingest/common.ip_validation
@@ -0,0 +1,22 @@
+{
+  "processors": [
+    {
+      "convert": {
+        "field": "_ingest._value",
+        "type": "ip",
+        "target_field": "_ingest._temp_ip",
+        "ignore_failure": true
+      }
+    },
+    {
+      "append": {
+        "field": "temp._valid_ips",
+        "allow_duplicates": false,
+        "value": [
+          "{{{_ingest._temp_ip}}}"
+        ],
+        "ignore_failure": true
+      }
+    }
+  ]
+}