# FIlter IP range in Pipeline

**URL:** <https://community.graylog.org/t/filter-ip-range-in-pipeline/20416>\
**Category:** Graylog Tech Challenges\
**Tags:** pipeline-rules, debuggingpl\
**Created:** [July 6, 2021, 10:21am UTC](https://community.graylog.org/t/filter-ip-range-in-pipeline/20416 "2021-07-06T10:21:34Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![baoletrg](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@baoletrg](https://community.graylog.org/u/baoletrg)\
**Post date:** [July 6, 2021, 10:21am UTC](https://community.graylog.org/t/filter-ip-range-in-pipeline/20416/1 "2021-07-06T10:21:34Z")

</div>

Hello, Im new to Graylog and currently using the rule below to filter log to a stream of 2 devices: 101.53.0.29 and 10.12.4.80; I want to drop all msg from 10.12.4.80  
rule “filter IP range 101.53.0.0/24”  
when  
NOT cidr\_match(“101.53.0.0/24”, to\_ip($message.gl2\_remote\_ip))  
then  
drop\_message();  
end  
But it keeps comming, so what is the problem? Thanks a lot.

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [July 7, 2021, 5:31pm UTC](https://community.graylog.org/t/filter-ip-range-in-pipeline/20416/2 "2021-07-07T17:31:24Z")

</div>

I wouldn’t put the “/” in the rule name … likely not the issue though - Maybe use the [debug()](https://docs.graylog.org/en/latest/pages/pipelines/functions.html#debug) function in an adjacent rule so you can watch the value for gl2\_remote\_ip.

---

<div class="post-metadata">

**Author:** ![baoletrg](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@baoletrg](https://community.graylog.org/u/baoletrg)\
**Post date:** [July 8, 2021, 2:14am UTC](https://community.graylog.org/t/filter-ip-range-in-pipeline/20416/3 "2021-07-08T02:14:08Z")

</div>

Thanks for your reply. I have followed your suggestion, and the output of gl2\_remote\_ip is NULL. What is the problem with this field, i thought this is the built-in field of Graylog.

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [July 8, 2021, 12:42pm UTC](https://community.graylog.org/t/filter-ip-range-in-pipeline/20416/5 "2021-07-08T12:42:16Z")

</div>

Were you able to solve it?

---

<div class="post-metadata">

**Author:** ![baoletrg](https://avatars.discourse-cdn.com/v4/letter/b/c2a13f/32.png) [@baoletrg](https://community.graylog.org/u/baoletrg)\
**Post date:** [July 8, 2021, 12:56pm UTC](https://community.graylog.org/t/filter-ip-range-in-pipeline/20416/6 "2021-07-08T12:56:50Z")

</div>

Nothing is working. I did figure a way to take the IP of the message, by using rDNS option in INPUT then all the hostnames in source field are resolved into IP; tested with debug().  
However, another problem is up, I copied one of the log into simulator to test the stream pipeline, everything worked as expected but it did not work for the real log messages in Search: It stated that this simulator message can not be used in Dashboard, Search,… but they are still there.

---

<div class="post-metadata">

**Author:** ![MalinkinSA](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@MalinkinSA](https://community.graylog.org/u/MalinkinSA)\
**Post date:** [July 12, 2021, 10:56am UTC](https://community.graylog.org/t/filter-ip-range-in-pipeline/20416/7 "2021-07-12T10:56:42Z")

</div>

Hello, [baoletrg](https://community.graylog.org/u/baoletrg)  
first of all check **Message Processors Configuration** you must something like:

|1| AWS Instance Name Lookup | disabled |  
|2| GeoIP Resolver | active |  
|3| Message Filter Chain | active |  
|4| Pipeline Processor | active |

Try to change

```auto
NOT cidr_match(“101.53.0.0/24”, to_ip($message.gl2_remote_ip))

```

To

```auto
cidr_match(“10.12.4.0/24”, to_ip($message.gl2_remote_ip))

```

And check you ip field datatype.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 26, 2021, 10:56am UTC](https://community.graylog.org/t/filter-ip-range-in-pipeline/20416/8 "2021-07-26T10:56:51Z")

</div>

Closed on July 26, 2021, 10:56am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.