Add address_field config option to handle nested fields#29
Add address_field config option to handle nested fields#29estolfo merged 10 commits intologstash-plugins:mainfrom
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR adds a new address_field configuration option to the CIDR filter plugin, allowing users to specify a field reference for IP addresses that should be checked against network blocks. This enhancement enables handling of nested IP address arrays in event data structures.
Key changes:
- Introduces
address_fieldconfig option as an alternative to the existingaddressoption - Adds mutual exclusivity validation between
addressandaddress_fieldconfigurations - Refactors IP address extraction logic to support both field references and template strings
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| lib/logstash/filters/cidr.rb | Core implementation of address_field functionality and refactored address handling |
| spec/filters/cidr_spec.rb | Comprehensive test coverage for the new address_field option |
| logstash-filter-cidr.gemspec | Added dependency for field reference validation |
| docs/index.asciidoc | Documentation for the new address_field configuration option |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
yaauie
left a comment
There was a problem hiding this comment.
This looks to be on the right track.
I've suggested adding some specs for the behaviour when encountering events that aren't shaped correctly (though I have not run them locally).
Co-authored-by: Rye Biesemeyer <yaauie@users.noreply.github.com>
yaauie
left a comment
There was a problem hiding this comment.
The changes and specs look good.
We will need to bump the minor version and add changelog entry.
Add a new config option,
address_fieldthat is a field reference for addresses that should be checked.This handles the case when the event has nested addresses, such as the following:
With the current config option
address, it wasn't possible to define that all addresses in theiparray should be checked.Resolves #19