logstash-filter-geoip icon indicating copy to clipboard operation
logstash-filter-geoip copied to clipboard

Feature request: skip local subnetwork IPs when an array is provided

Open xo4n opened this issue 9 years ago • 4 comments

Would it be possible to skip private IPs when an array of IPs is provided instead of lookup the first IP of the array. It will be a matter of checking the IPs against the subnetworks as defined https://en.wikipedia.org/wiki/Private_network and then iterate to the next item in the array

xo4n avatar Dec 22 '15 13:12 xo4n

+1

IngaFeick avatar Dec 22 '15 13:12 IngaFeick

Hmm, I'm open to this idea. Skipping lookups on all RFC1918 addresses sounds like an OK default behavior - thoughts?

As for having an array, would it be useful to have multiple geoip lookup results? Or do you just want the first non-rfc1918 address looked up?

jordansissel avatar Dec 28 '15 20:12 jordansissel

@jordansissel I am currently working on something like this, will submit a PR somewhen this week. I chose to use the first non-private IP for lookup, but I'm open to suggestions :)

IngaFeick avatar Jan 04 '16 09:01 IngaFeick

@IngaFeick +1 on your proposal :)

jordansissel avatar Jan 04 '16 19:01 jordansissel