Skip to content

Instantly share code, notes, and snippets.

Last active March 10, 2023 15:04
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
What would you like to do?
Beat script processor to filter out IPv6
- script:
# This uses a Beat script processor to include only ipv4 addresses
# in the host.ip field. This would need to placed after the add_host_metadata
# processor.
# It would be a lot more efficient to have add_host_metadata allow controlling
# what addresses were included because this has to execute for every event.
# References:
lang: javascript
id: include-ipv4
source: |
var net = require('net');
function process(evt) {
var ips = evt.Get('host.ip');
if (!Array.isArray(ips) || ips.length == 0) {
var ipv4s = [];
for (var i = 0; i < ips.length; i++) {
var ip = ips[i];
if (net.isIPv4(ip)) {
evt.Put('host.ip', ipv4s);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment