topic Re: Route data to separate index based on CIDR in Getting Data In

Route data to separate index based on CIDR

IngloriousSplun — Tue, 31 Mar 2015 15:22:19 GMT

I have a requirement to route data that falls within two /24 CIDR ranges to a separate index, say 10.0.1.0/24 and 10.0.2.0/24. The event traffic does not come from a specific host, however, all of our traffic does aggregate to a common heavy forwarder. The events coming in are either XML or syslog and each has a specific field that displays the IP, either source or destination such as or .

My thought was to use transforms.conf and props.conf to route the traffic, but I'm not sure how to specify to only route to this index if the IP falls within the two desired /24 CIDR blocks.

Thanks.

Re: Route data to separate index based on CIDR

IngloriousSplun — Tue, 31 Mar 2015 19:28:37 GMT

This is what I came up with, but not sure if this is going to work:

props.conf

[netblock1-ingress]
TRANSFORMS-route = netblock1-ingress

[netblock1-egress]
TRANSFORMS-route = netblock1-egress

[netblock2-ingress]
TRANSFORMS-route = netblock2-ingress

[netblock2-egress]
TRANSFORMS-route = netblock2-egress

transforms.conf

[netblock1-ingress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.1\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock1-egress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.1\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock2-ingress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.2\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock2-egress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.2\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

This is what my raw event looks like for XML:

<?xml version="1.0" encoding="utf-8"?>
<alerts appliance="..." xmlns="..." xmlns:xsi="...">
  <alert id="12345" name="test-alert">
    <details ...>
      <content>
      </content>
    </details>
    <src vlan="1">
      <ip>10.0.1.25</ip>
      <port></port>
    </src>
    <dst>
      <ip>1.2.4.5</ip>
      <port></port>
    </dst>
  </alert>
</alerts>


    <?xml version="1.0" encoding="utf-8"?>
    <alerts appliance="..." xmlns="..." xmlns:xsi="...">
      <alert id="12345" name="test-alert">
        <details ...>
          <content>
          </content>
        </details>
        <src vlan="1">
          <ip>1.2.4.5</ip>
          <port></port>
        </src>
        <dst>
          <ip>10.0.1.25</ip>
          <port></port>
        </dst>
      </alert>
    </alerts>

Thoughts?

Re: Route data to separate index based on CIDR

JasonCarter80 — Wed, 29 Jul 2015 02:30:06 GMT

Did you get this working?

Re: Route data to separate index based on CIDR

shan_santosh — Tue, 13 Dec 2016 10:00:03 GMT

How can I implement the same logic for host. I want to route the events to different indexes based on source and host name. Any suggestion?