Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add IP-addresses and MAC-addresses to event #5396

Closed
hypp opened this issue Oct 15, 2017 · 12 comments
Closed

Add IP-addresses and MAC-addresses to event #5396

hypp opened this issue Oct 15, 2017 · 12 comments

Comments

@hypp
Copy link
Contributor

hypp commented Oct 15, 2017

This is a feature request as requested here.

I would like to dynamically add all IP-addresses and all MAC-addresses of the sender host to each event sent by filebeat.

I propose that it is implemented as a new processor similar to add_locale.
Something like:
Loop over net.Interfaces() to get the HardwareAddr field,
skip loopback interfaces,
skip empty HardwareAddr fields,
convert to a string and store them in a list,
and then event.Put(key, list) to every event.
And a second inner loop over Interface.Addrs() to get the IP-addresses in a similar way.

I think that "key" should be user configurable.

If needed I can contribute with the code for this.

@ruflin
Copy link
Contributor

ruflin commented Oct 16, 2017

Thanks for filing this. I think we still need to figure out where this would fit best in. I could see this as a processor like add_host_metadata which probably does more then just ip address and mac address, but for example also fetches the OS. @andrewkroh Other thoughts?

@omairkhalid20
Copy link

Hi, @ruflin @andrewkroh and @hypp , so has this feature been developed or has been parked for now.

@ruflin
Copy link
Contributor

ruflin commented Apr 13, 2018

@omairkhalid20 We recently added the add_host_metadata processor but by now it does not contain yet the mac address. But this is probably a good time to restart the discussion.

@hypp @omairkhalid20 Interested in opening a PR against the add_host_metadata processor? That would probably fast track the discussion.

@hypp
Copy link
Contributor Author

hypp commented Apr 16, 2018

@ruflin I can open a PR for this. Just so I understand correctly: I fork the beats repo, create a new topic branch, make my code changes, and then submit a pull request?

@ruflin
Copy link
Contributor

ruflin commented Apr 17, 2018

@hypp exactly. On the PR we can then directly discuss if we should have config options for it etc. Feel free to open a PR early.

@hypp
Copy link
Contributor Author

hypp commented Apr 17, 2018

Ok, should be done now. I have never contributed before, so I hope that I got it right?

@ruflin
Copy link
Contributor

ruflin commented Apr 17, 2018

@hypp Looks great, left some comments on the PR. Let's continue the discussion there.

ruflin pushed a commit that referenced this issue May 4, 2018
@gk4
Copy link

gk4 commented Jun 26, 2018

I'm looking for this patch to apply to beats-6.2.2 and/or 6.3 Where can I find it?

@ruflin
Copy link
Contributor

ruflin commented Jun 27, 2018

It didn't make it into 6.3, will be 6.4. For snapshot builds see #6878 (comment)

@q2dg
Copy link

q2dg commented Apr 4, 2019

It isn't in Journalbeat 6.7 :-(

@q2dg
Copy link

q2dg commented Feb 21, 2020

It isn't in Journalbeat 7.6 :-(

@andrewkroh
Copy link
Member

The feature to add IPs and MACs to events has existed since 6.4. It's disabled by default for the add_host_metadata processor. If you set netinfo.enabled: true it will be enabled. See the docs. Very recently in #16077 the processor was changed to make netinfo.enabled: true the default value.

processors:
- add_host_metadata:
    netinfo.enabled: true

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

6 participants