# Exclude IPv6 addresses in pipeline rule?

**URL:** <https://community.graylog.org/t/exclude-ipv6-addresses-in-pipeline-rule/27873>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [February 27, 2023, 7:52pm UTC](https://community.graylog.org/t/exclude-ipv6-addresses-in-pipeline-rule/27873 "2023-02-27T19:52:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![faen](https://avatars.discourse-cdn.com/v4/letter/f/71e660/32.png) [@faen](https://community.graylog.org/u/faen)\
**Post date:** [February 27, 2023, 7:52pm UTC](https://community.graylog.org/t/exclude-ipv6-addresses-in-pipeline-rule/27873/1 "2023-02-27T19:52:36Z")

</div>

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.  
**Don’t forget to select tags to help index your topic!**

**1. Describe your incident:**

I recently set up an integration to GreyNoise Community and it is working swimmingly, except I get occasional errors in my Graylog log:

```auto
WARN [GreyNoiseCommunityIpLookupAdapter] '::1' is an IPv6 Address. 'GreyNoise Community IP Lookup' does not support IPv6 Addresses

```

I would like to filter the IPv6 addresses within the pipeline rule calling the lookup so that they are not sent to GreyNoise.

**2. Describe your environment:**

- OS Information: Ubuntu 22.04

- Package Version: 5.0.3+a82acb2

- Service logs, configurations, and environment variables:

```auto
WARN [GreyNoiseCommunityIpLookupAdapter] '::1' is an IPv6 Address. 'GreyNoise Community IP Lookup' does not support IPv6 Addresses

```

**3. What steps have you already taken to try and solve the problem?**

I added the below to my pipeline rule, but I have a low confidence that I am using the function correctly. Hoping someone can spot an error or make a suggestion on another way to avoid running the rule action on IPv6 addresses.

Here’s the when block:

```auto
when
    has_field("SrcIP") && 
    is_ip(to_ip($message.SrcIP)) &&
    !grok_exists("%{IPV6:$message.SrcIP}") &&
    !in_private_net(to_string($message.SrcIP)) &&
    !cidr_match("169.254.0.0/16",to_ip($message.SrcIP)) 
then

```

The `!grok_exists("%{IPV6:$message.SrcIP}") &&` is intended to stop processing if there is an IPv6 address in the SrcIP field, but it is not working.

**4. How can the community help?**

Provide advice on getting the pipeline rule to stop processing in the event of an IPv6 address.

**Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab]

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [February 28, 2023, 2:50am UTC](https://community.graylog.org/t/exclude-ipv6-addresses-in-pipeline-rule/27873/2 "2023-02-28T02:50:54Z")

</div>

Hey @faen

Not quite sure if this will work for ya. Here are couple examples:

```auto
rule "proxy address"
When 
 cidr_match("91.0.0.0/8", to_ip("91.184.102.100")) &&
  ! cidr_match("92.0.0.0/8", to_ip("91.184.102.100"))
then
   set_field("proxy_address", "91.184.102.100");
end

```

And/Or something like this?

```auto
rule "from datacenter subnet"
when
    cidr_match("192.168.1.0/24", to_ip($message.gl2_remote_ip)) OR cidr_match("192.168.2.0/24", to_ip($message.gl2_remote_ip)) 
then
    set_field("new_field",);
end

```

Or perhap use `regex_replace();`

Example:

```auto
rule "IPv6 "
when
  has_field("message")
then
  let anonym_ip = regex_replace(
    pattern: "([0-9A-Fa-f]{1,4}):([0-9A-Fa-f]{1,4}):([0-9A-Fa-f]{1,4}):([0-9A-Fa-f]{1,4}):([0-9A-Fa-f]{1,4}):([0-9A-Fa-f]{1,4}):([0-9A-Fa-f]{1,4}):([0-9A-Fa-f]{1,4}|:)",
    value: to_string($message.message),
    replacement: "$1:$2:yyy:yyy:yyy:yyy:yyy::"
  );
  set_field("message", anonym_ip);
end

```

---

<div class="post-metadata">

**Author:** ![faen](https://avatars.discourse-cdn.com/v4/letter/f/71e660/32.png) [@faen](https://community.graylog.org/u/faen)\
**Post date:** [March 2, 2023, 3:27pm UTC](https://community.graylog.org/t/exclude-ipv6-addresses-in-pipeline-rule/27873/3 "2023-03-02T15:27:18Z")

</div>

Sorry for the late reply here @gsmith, I’ve had a pretty busy week with other things.

I think your 3rd example might be close to what I am looking for. I might add a rule to make a flag for IPv6 addresses that can be used to exclude those messages from data enrichment that does not support IPv6. I’ll post an update when I have time to get it running.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 16, 2023, 3:27pm UTC](https://community.graylog.org/t/exclude-ipv6-addresses-in-pipeline-rule/27873/4 "2023-03-16T15:27:22Z")

</div>

Closed on March 16, 2023, 3:27pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.