Would like to add list names to a message. Adding a list name to a INET (IPv4/IPv6) lookup. I.e. 10.20.30.40 is present in the following lists … badguys#1, badguys#2, … and then be able to do statistics on badguys#1 and badguys#2.
AlmaLinux/Docker/OpenSearch. Current.
Looked at multi-value CSV and JSON, but was not successful. Tried a lookup adapter per list, but my lists names are very dynamic and to many to lists are involved. +40 with 5 changes every week. Would be nice to be able to create the lookup table elsewhere and not do changes to the Graylog itself.
Could someone perhaps guide me down the right path?