I am trying to get the ISP for an IP address using a database with cidr ip blocks
The lookup file is "GeoIPISP.csv" with these columns
The main search is something like
index="nginx" | top ip
I am trying to use cidrmatch, but it requires to cidr block as the first parameter.
How do I join them together to show the ISP?
cidrmatch is a function for eval or where. You're not showing how you'd use it, but I think you might be misinterpreting the instructions.
the syntax is:
the first parameter, X is the CIDR but the order of parameters has nothing to do with...anything else.
So you would look em up, and then do the eval and whatever else you want.
But that's not what it seems you're looking for.
The definition in transforms.conf for the lookup needs:
transforms.conf [geoIPISP] filename=GeoIPISP.csv match_type=CIDR(isp)
index=nginx|[inputlookup geoIPISP |fields isp |rename isp AS ip]|top ip limit=1
The search example you have isn't looking at the lookup table.
So you use a sub search to grab the value and that's passed to the outer search. (and the rename normalizes the filenames)
I want to match an IP in the log file to an ISP defined in the GeoIPISP lookup.
so, assume If I run this search:
index="nginx" | top limit=1
Also assume, GeoIPISP.csv has two lines:
I want to look up that IP 22.214.171.124 is in the cidr block of 126.96.36.199/24<http://188.8.131.52/24>, which then returns the ISP Google.
From the info above, I think this will work
filename = GeoIPISP_cidr.csv
max_matches = 1
min_matches = 1
default_match = OK
match_type = CIDR(ip)
LOOKUP-geoip = geoip_isp ip OUTPUT start_ip end_ip isp
Then this search
index="nginx" | top isp limit=1
is that right, or am I missing something?
I've edited my answer now that the question is more clear.
Your example doesn't actually touch the lookup table at all... so I wasn't sure where you were going.