Route data to separate index based on CIDR

[IngloriousSplun]

I have a requirement to route data that falls within two /24 CIDR ranges to a separate index, say 10.0.1.0/24 and 10.0.2.0/24. The event traffic does not come from a specific host, however, all of our traffic does aggregate to a common heavy forwarder. The events coming in are either XML or syslog and each has a specific field that displays the IP, either source or destination such as or .

My thought was to use transforms.conf and props.conf to route the traffic, but I'm not sure how to specify to only route to this index if the IP falls within the two desired /24 CIDR blocks.

Thanks.

[IngloriousSplun]

This is what I came up with, but not sure if this is going to work:

props.conf

[netblock1-ingress]
TRANSFORMS-route = netblock1-ingress

[netblock1-egress]
TRANSFORMS-route = netblock1-egress

[netblock2-ingress]
TRANSFORMS-route = netblock2-ingress

[netblock2-egress]
TRANSFORMS-route = netblock2-egress

transforms.conf

[netblock1-ingress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.1\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock1-egress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.1\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock2-ingress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.2\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock2-egress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.2\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

This is what my raw event looks like for XML:

<?xml version="1.0" encoding="utf-8"?>
<alerts appliance="..." xmlns="..." xmlns:xsi="...">
  <alert id="12345" name="test-alert">
    <details ...>
      <content>
      </content>
    </details>
    <src vlan="1">
      <ip>10.0.1.25</ip>
      <port></port>
    </src>
    <dst>
      <ip>1.2.4.5</ip>
      <port></port>
    </dst>
  </alert>
</alerts>


    <?xml version="1.0" encoding="utf-8"?>
    <alerts appliance="..." xmlns="..." xmlns:xsi="...">
      <alert id="12345" name="test-alert">
        <details ...>
          <content>
          </content>
        </details>
        <src vlan="1">
          <ip>1.2.4.5</ip>
          <port></port>
        </src>
        <dst>
          <ip>10.0.1.25</ip>
          <port></port>
        </dst>
      </alert>
    </alerts>

Thoughts?

[JasonCarter80]

Did you get this working?

[shan_santosh]

How can I implement the same logic for host. I want to route the events to different indexes based on source and host name. Any suggestion?