logstash-filter-geoip
logstash-filter-geoip copied to clipboard
Feature request: skip local subnetwork IPs when an array is provided
Would it be possible to skip private IPs when an array of IPs is provided instead of lookup the first IP of the array. It will be a matter of checking the IPs against the subnetworks as defined https://en.wikipedia.org/wiki/Private_network and then iterate to the next item in the array
+1
Hmm, I'm open to this idea. Skipping lookups on all RFC1918 addresses sounds like an OK default behavior - thoughts?
As for having an array, would it be useful to have multiple geoip lookup results? Or do you just want the first non-rfc1918 address looked up?
@jordansissel I am currently working on something like this, will submit a PR somewhen this week. I chose to use the first non-private IP for lookup, but I'm open to suggestions :)
@IngaFeick +1 on your proposal :)