Adds .cidr and .netmask

[robgil]

Ref: #86

For use with DHCP logs, Firewall logs, or BGP logs.

Adds source.cidr, source.netmask, destination.cidr,destination.netmask, network.cidr, and network.netmask.

[ruflin]

PR will need a changelog entry.

So far I assumed cidr/netmask will added to network. In which cases network is used and when is source/desitation used? And where do I search if I want to search across all of them?

[ruflin]

Could you add examples as you did in the others above?

Nit: Please add dots at the end of the descriptions as it will show up like this in the docs.

[webmat]

@ruflin:

where do I search if I want to search across all of them?

A: Someone who uses .cidr and .netmask in multiple places should also add all these values in related.cidr and related.netmask, to simplify searching across all of them at the same time.

[webmat]

Agree with Nic on changelog, examples and periods at the end of the descriptions.

New request: .cidr should be ip_range. The .netmask fields are fine as ip, however.

[webmat]

Each .cidr field should actually be of type ip_range [1], not ip [2]. You can search an ip field with a CIDR range, but you can't store a range directly in it.

If you want to play with these in a Kibana console:

PUT ip_test
{ "mappings": {
    "_doc": {
      "properties": {
        "address": {
          "type": "ip"
        },
        "range": {
          "type": "ip_range"
}}}}}

PUT ip_test/_doc/1
{ "address": "127.0.0.1" }
PUT ip_test/_doc/2
{ "address": "::1" }
PUT ip_test/_doc/3
{ "address": "255.255.255.0" }
# Fails:
PUT ip_test/_doc/4
{ "address": "10.0.0.0/8" }
PUT ip_test/_doc/4
{ "range": "10.0.0.0/8" }
# Fails:
PUT ip_test/_doc/5
{ "range": "255.255.255.0" }

GET ip_test/_search
DELETE ip_test

• [1] https://www.elastic.co/guide/en/elasticsearch/reference/current/ip.html
• [2] https://www.elastic.co/guide/en/elasticsearch/reference/current/range.html#ip-range

[webmat]

Tip: in your PR body, if you have a line that says "Closes #86", GitHub will close the referenced issue automatically when this PR is merged. :-)

[MikePaquette]

I am closing this PR as it is outdated and the contributor is no longer active.