Subnet Search Query

[maniel (Daniel)]

according to this thread:

Match a String Against Regex in Pipeline Processors

You can access the boolean matches property of the result:

you can use regex in when clause:

when
  has_field("ip") && regex("ip matching regex", to_string($message.ip)).matches == false &&
  has_field("categoryOutcome") && to_string($message.categoryOutcome) == "Success"
then
  // do something
end

regex in your case would look something like this ^(192\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1]))