Issue with gl2_remote_ip

jochen · February 12, 2018, 10:36am

The gl2_remote_ip is being set only if the raw message (received by the network transport) does contain information about the remote address:

github.com

Graylog2/graylog2-server/blob/2.4.3/graylog2-server/src/main/java/org/graylog2/shared/buffers/processors/DecodingProcessor.java#L228-L231


final ResolvableInetSocketAddress remoteAddress = raw.getRemoteAddress();
if (remoteAddress != null) {
    final String addrString = InetAddresses.toAddrString(remoteAddress.getAddress());
    message.addField("gl2_remote_ip", addrString);

Some inputs don’t set this remote address information, so you might be out of luck.

You could also use the debug() function to check the actual contents of the messages for which the rule is being executed.

Topic		Replies	Views
Pipeline rule for adding actual source ip does not seem to do anything Graylog Central (peer support) pipeline-rules	2	304	September 26, 2023
How to use gl2_remote_ip in Stream-Rule Graylog Central (peer support) pipeline-rules	5	3970	November 30, 2017
IP Address Check / Match Graylog Central (peer support)	3	626	June 4, 2020
Extractor using gl2_remote_ip Graylog Central (peer support)	5	1444	February 7, 2019
Use the API to query for the source IP (g2_remote_ip) over a specified timeframe Graylog Central (peer support)	2	484	September 23, 2019

Issue with gl2_remote_ip

Related topics