Add IP-addresses and MAC-addresses to event

[hypp]

This is a feature request as requested here.

I would like to dynamically add all IP-addresses and all MAC-addresses of the sender host to each event sent by filebeat.

I propose that it is implemented as a new processor similar to add_locale.
Something like:
Loop over net.Interfaces() to get the HardwareAddr field,
skip loopback interfaces,
skip empty HardwareAddr fields,
convert to a string and store them in a list,
and then event.Put(key, list) to every event.
And a second inner loop over Interface.Addrs() to get the IP-addresses in a similar way.

I think that "key" should be user configurable.

If needed I can contribute with the code for this.

[ruflin]

Thanks for filing this. I think we still need to figure out where this would fit best in. I could see this as a processor like add_host_metadata which probably does more then just ip address and mac address, but for example also fetches the OS. @andrewkroh Other thoughts?

[omairkhalid20]

Hi, @ruflin @andrewkroh and @hypp , so has this feature been developed or has been parked for now.

[ruflin]

@omairkhalid20 We recently added the add_host_metadata processor but by now it does not contain yet the mac address. But this is probably a good time to restart the discussion.

@hypp @omairkhalid20 Interested in opening a PR against the add_host_metadata processor? That would probably fast track the discussion.

[hypp]

@ruflin I can open a PR for this. Just so I understand correctly: I fork the beats repo, create a new topic branch, make my code changes, and then submit a pull request?

[ruflin]

@hypp exactly. On the PR we can then directly discuss if we should have config options for it etc. Feel free to open a PR early.

[hypp]

Ok, should be done now. I have never contributed before, so I hope that I got it right?

[ruflin]

@hypp Looks great, left some comments on the PR. Let's continue the discussion there.

[gk4]

I'm looking for this patch to apply to beats-6.2.2 and/or 6.3 Where can I find it?

[ruflin]

It didn't make it into 6.3, will be 6.4. For snapshot builds see #6878 (comment)

[q2dg]

It isn't in Journalbeat 6.7 :-(

[q2dg]

It isn't in Journalbeat 7.6 :-(

[andrewkroh]

The feature to add IPs and MACs to events has existed since 6.4. It's disabled by default for the add_host_metadata processor. If you set netinfo.enabled: true it will be enabled. See the docs. Very recently in #16077 the processor was changed to make netinfo.enabled: true the default value.

processors:
- add_host_metadata:
    netinfo.enabled: true