The following processor can turn valid IPv6 address into invalid ones.
|
- gsub: |
|
field: source.ip |
|
pattern: "::ffff:" |
|
replacement: "" |
|
ignore_missing: true |
Examples:
fe80::ffff:ffff:fffe -> fe80ffff:fffefe80::ffff:ffff:ffff:ffff -> fe80ffff:ffff:ffff
Which then later causes errors such as 'fe80ffff:ffff:ffff' is not an IP string literal. in other processors. It also causes other issues.
I believe this processor's intent is to transform IPs such as ::ffff:192.168.1.1 into 192.168.1.1. In which case, the pattern should be ^::ffff: to anchor the pattern at the beginning of the string. (See my below comment for a better proposed solution.)
- gsub:
field: source.ip
pattern: "^::ffff:"
replacement: ""
ignore_missing: true
I tested this in a simulated pipeline using both fe80::ffff:ffff:fffe and ::ffff:192.168.1.1 values. It correctly left the former untouched and correctly stripped the prefix from the latter.
References:
The following processor can turn valid IPv6 address into invalid ones.
integrations/packages/system/data_stream/security/elasticsearch/ingest_pipeline/default.yml
Lines 11 to 15 in af36780
Examples:
fe80::ffff:ffff:fffe->fe80ffff:fffefe80::ffff:ffff:ffff:ffff->fe80ffff:ffff:ffffWhich then later causes errors such as
'fe80ffff:ffff:ffff' is not an IP string literal.in other processors. It also causes other issues.I believe this processor's intent is to transform IPs such as
::ffff:192.168.1.1into192.168.1.1. In which case, the pattern should be^::ffff:to anchor the pattern at the beginning of the string. (See my below comment for a better proposed solution.)I tested this in a simulated pipeline using both
fe80::ffff:ffff:fffeand::ffff:192.168.1.1values. It correctly left the former untouched and correctly stripped the prefix from the latter.References: