This logstash filter tags events according to a list of CIDR to tag mappings, and optionally maps ASN numbers to names

Example:

cidrtagmap {
    #redisserver => '127.0.0.1'
    #redisnamespace => "ereiamjh"
        mapfilepath => "/path/to/ipmap/file"
        asnmapfilepath => "/path/to/asnmap/file"
        ipfieldlist => [
        'host',
        '[netflow][dst_address]',
        '[etc]'
    ]
        asfieldlist => [
        '[netflow][dst_as]',
        '[netflow][src_as]
    ]
}

CIDR map configuration

You must specify a map source. Currently there are two forms of this: file based and redis based.

File based configuration:

• mapfilepath points to an external / stand alone text file consisting of lines of the form:

<network>/<mask>,<tag>[,<tag>...]

The filter can be made to re-load its in-memory representation of the contents of the ipmap file without interrupting/restarting the logstash instance by touching a flag file.

touch <mapfilepath>.RELOAD

Redis based configuration:

• redisserver = name or ip address of redis server to connect to. If you define this you should also define:
• redisnamespace = string that will act as a prefix to variables stored in redis

In redis then you should define two items:

• redisnamespace.cidrmap = a hash with cidr => tag kv pairs. The value can be a comma separated list of tags.
• redisnamespace.reloadmap = 1|0 - tell filter to reload map

Other configuration:

• ipfieldlist (required) is a list of event fields that will be eligible for mapping. Everything that matches will be put in a structure subtending an item called cidrtagmap, so from the above example a match of the [netflow][dst_address] field would add cidrtagmap.netflow.dst_address.tags. A pair to this field will be cidrtagmap.netflow.dst_address.match which indicates which rule was matched for the mapping.

• asnmapfilepath (optional) points to a copy of this file: ftp://ftp.arin.net/info/asn.txt

• asnfieldlist (optional) is a list of fields presumed to contain asn numbers. Everything that matches will add e.g. cidrtagmap.netflow.dst_as.asname