02-filter.conf

filter{
    if [destination][ip] {
        memcached {
            hosts => ["memcached:11211"]
            namespace => "misp-ip"
            get => {
                "%{[destination][ip]}" => "[enrich][tmp]"
            }
        }
        if [enrich][tmp] {
            ruby {
                path => "/etc/logstash/process_ioc.rb"
            }
            mutate {
                remove_field => [ "[enrich]" ]
            }
        }
    }
    if [dns][resolved_ip] {
        memcached {
            hosts => ["memcached:11211"]
            namespace => "misp-ip"
            get => {
                "%{[dns][resolved_ip]}" => "[enrich][tmp]"
            }
        }
        if [enrich][tmp] {
            ruby {
                path => "/etc/logstash/process_ioc.rb"
            }
            mutate {
                remove_field => [ "[enrich]" ]
            }
        }
    }
    if [dns][question][registered_domain] {
        memcached {
            hosts => ["memcached:11211"]
            namespace => "misp-domain"
            get => {
                "%{[dns][question][registered_domain]}" => "[enrich][tmp]"
            }
        }
        if [enrich][tmp] {
            ruby {
                path => "/etc/logstash/process_ioc.rb"
            }
            mutate {
                remove_field => [ "[enrich]" ]
            }
        }
    }
    if [hash][sha256] {
        memcached {
            hosts => ["memcached:11211"]
            namespace => "misp-sha256"
            get => {
                "%{[hash][sha256]}" => "[enrich][tmp]"
            }
        }
        if [enrich][tmp] {
            ruby {
                path => "/etc/logstash/process_ioc.rb"
            }
            mutate {
                remove_field => [ "[enrich]" ]
            }
        }
    }
}