Skip to content

Add address_field config option to handle nested fields#29

Merged
estolfo merged 10 commits intologstash-plugins:mainfrom
estolfo:address_field
Oct 20, 2025
Merged

Add address_field config option to handle nested fields#29
estolfo merged 10 commits intologstash-plugins:mainfrom
estolfo:address_field

Conversation

@estolfo
Copy link
Contributor

@estolfo estolfo commented Oct 8, 2025

Add a new config option, address_field that is a field reference for addresses that should be checked.
This handles the case when the event has nested addresses, such as the following:

"host": {
      "ip": [
        "fe80::xxxx:xxxx:xxxx:xxx",
        "10.x.x.x",
        "fe80::xxxx:xxxx:xxxx:xxx",
        "10.x.x.x"
      ],
      "name": "HOSTNAME"
    },

With the current config option address, it wasn't possible to define that all addresses in the ip array should be checked.

Resolves #19

@estolfo estolfo requested review from Copilot and yaauie October 8, 2025 12:09
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds a new address_field configuration option to the CIDR filter plugin, allowing users to specify a field reference for IP addresses that should be checked against network blocks. This enhancement enables handling of nested IP address arrays in event data structures.

Key changes:

  • Introduces address_field config option as an alternative to the existing address option
  • Adds mutual exclusivity validation between address and address_field configurations
  • Refactors IP address extraction logic to support both field references and template strings

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File Description
lib/logstash/filters/cidr.rb Core implementation of address_field functionality and refactored address handling
spec/filters/cidr_spec.rb Comprehensive test coverage for the new address_field option
logstash-filter-cidr.gemspec Added dependency for field reference validation
docs/index.asciidoc Documentation for the new address_field configuration option

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

@estolfo estolfo changed the title Address field Oct 8, 2025
@estolfo estolfo changed the title Add address_field config option Oct 8, 2025
Copy link
Contributor

@yaauie yaauie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks to be on the right track.

I've suggested adding some specs for the behaviour when encountering events that aren't shaped correctly (though I have not run them locally).

Copy link
Contributor

@yaauie yaauie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changes and specs look good.

We will need to bump the minor version and add changelog entry.

@estolfo estolfo requested a review from yaauie October 15, 2025 08:18
Copy link
Contributor

@yaauie yaauie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍🏼 LGTM

@estolfo estolfo merged commit 48ed71c into logstash-plugins:main Oct 20, 2025
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants