Hello Community
I'm working on a custom parser and i see that the ip in the raw log is in this format :
"AUDIT_SOURCE_IP": "147.1.1.1,34.1.1.7",
As you see two IP's in single field and getting this error while parsing :
generic::unknown: invalid event 0: LOG_PARSING_GENERATED_INVALID_EVENT: "field type check failed: field backstory.Noun.ip[0] \\""147.1.1.1,34.1.1.7\\" does not match type IP: invalid argument"
how i can resolve that please ?
This one is actually pretty simple. Just iterate through the IP list and add them to the UDM field one at a time.
if [ip] != "" {
for myIP in AUDIT_SOURCE_IP {
mutate {
merge => {
"event.idm.read_only_udm.principal.ip" => "%[myIP]"
}
on_error => "zerror.no_principal_ip"
}
}
}
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.