I have a field called packetbeat_client_ip with a value of 192.168.x.x
how to convert value (IP) to name (string ) for example ip=customer
I want to replace IP with a string name for all fields and how should I solve this problem?
Thank you for your cooperation and guidance
<code>rule "pipeline change ipaddr to name "
when
has_field("packetbeat_http_request_headers_x-real-ip")
then
let update_source = lookup_value("lookup-ip",$message.packetbeat_http_request_headers_x-real-ip);
set_field("packetbeat_http_request_headers_x-real-ip_new",update_source);
</code>
<code>rule "pipeline change ipaddr to name "
when
has_field("packetbeat_http_request_headers_x-real-ip")
then
let update_source = lookup_value("lookup-ip",$message.packetbeat_http_request_headers_x-real-ip);
set_field("packetbeat_http_request_headers_x-real-ip_new",update_source);
</code>
rule "pipeline change ipaddr to name "
when
has_field("packetbeat_http_request_headers_x-real-ip")
then
let update_source = lookup_value("lookup-ip",$message.packetbeat_http_request_headers_x-real-ip);
set_field("packetbeat_http_request_headers_x-real-ip_new",update_source);
end