topic Re: Using an IP range in Inputs.conf in Getting Data In

Using an IP range in Inputs.conf

bongski — Wed, 24 Oct 2012 21:11:09 GMT

Hey,

I was hoping someone can clarify if an IP range to subnet can be used in Inputs.conf.

For example all hosts on

192.168.1.0/24 (192.168.1.0-192.168.1.254) go to index A.

192.168.2.0/24 (192.168.2.0-192.168.2.254) goes to index B.

I have read though the documentation but I can't seem to find anything. Also if it is possible what is the correct syntax for the file?

[tcp://192.168.1.0/24:5000]

[tcp://192.168.1.0-192.168.1.254:5000]

If I have missed something in the documentation I apologise.

Re: Using an IP range in Inputs.conf

lguinn2 — Thu, 25 Oct 2012 00:03:16 GMT

I do not believe this possible. However, you can redirect inputs to different indexes, just not with inputs.conf. Here is how:

inputs.conf

[tcp://:5000]
connection_host = ip
sourcetype = mixedinputs
index=defaultIndex

props.conf

[mixedinputs]
TRANSFORM=separate_inputs1, separate_inputs2

transforms.conf

[separate_inputs1]
SOURCE_KEY=MetaData:Host
REGEX=host::192\.168\.1\.1
DEST_KEY=_MetaData:Index
FORMAT=A

[separate_inputs2]
SOURCE_KEY=MetaData:Host
REGEX=host::10\.1\.\d+\.\d+
DEST_KEY=_MetaData:Index
FORMAT=B

First, this assigns all inbound events from port 5000 to defaultIndex (whatever you want to call it). Then, as the data is processed, each event is examined. If the host field (ip) of an event matches the regular expression (REGEX), the event is reassigned to the index named in FORMAT.

Note that you can write the REGEX to "wildcard" the octets, but I don't now how to use CIDR notation with regular expressions.

Re: Using an IP range in Inputs.conf

bongski — Thu, 25 Oct 2012 12:06:16 GMT

Thanks for the tip, I will impletment it that way and let you know how I go.

Re: Using an IP range in Inputs.conf

MuS — Thu, 25 Oct 2012 12:33:03 GMT

why not just use the index stanza in inputs.conf on the forwarder, should work as well.

Re: Using an IP range in Inputs.conf

bongski — Mon, 29 Oct 2012 04:58:42 GMT

This worked great, the solution is a bit CPU intensive but worked exactly how I needed it to.

Re: Using an IP range in Inputs.conf

lguinn2 — Mon, 29 Oct 2012 06:28:57 GMT

Yeah, the event-by-event processing will always cost more resources than the "index the whole input stream from this port" method. There is always a trade-off 😉