As per a request in elastic/kibana#68424 (comment), I'm logging this issue in elasticsearch too.
I would like to perform aggregations of documents containing an ip field into CIDR subnets of a specific size.
If I collect IPs of services talking to each others from a network point-of-view (ex. within a datacenter), I can produce top talkers per subnet, top subnets, etc.
Ideally, I would be able to configure subnet mask to gradually refine during investigations (group per /16 first, then /24, etc.).
With raw IP addresses indexed, in the end I could produce such views:
| Subnet (based on ip_address field) |
Avg performance (ms) |
| 10.2.0.0/16 |
1.2 |
| 10.3.0.0/16 |
1.5 |
| 10.4.0.0/16 |
5.8 < any issue? |
Thanks,
As per a request in elastic/kibana#68424 (comment), I'm logging this issue in elasticsearch too.
I would like to perform aggregations of documents containing an
ipfield into CIDR subnets of a specific size.If I collect IPs of services talking to each others from a network point-of-view (ex. within a datacenter), I can produce top talkers per subnet, top subnets, etc.
Ideally, I would be able to configure subnet mask to gradually refine during investigations (group per /16 first, then /24, etc.).
With raw IP addresses indexed, in the end I could produce such views:
Thanks,