Type to search.

Network direction processor

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack 9.4+

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available since 9.4

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The Network direction processor determines network traffic direction (inbound, outbound, internal, or external) based on source and destination IP addresses.

To determine network direction:

  1. Select Create → Create processor.
  2. Select Network direction from the Processor menu.
  3. Set the Source IP to the field containing the source IP address.
  4. Set the Destination IP to the field containing the destination IP address.
  5. Set the internal networks using either a list of CIDR ranges or a field containing the list.

In YAML mode, configure the network direction processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

Specify exactly one of internal_networks or internal_networks_field.

Parameter Type Required Description
source_ip string Yes Field containing the source IP address.
destination_ip string Yes Field containing the destination IP address.
target_field string No Target field for the direction result.
internal_networks string[] One of internal_networks or internal_networks_field List of internal network CIDR ranges.
internal_networks_field string One of internal_networks or internal_networks_field Field containing the list of internal networks.
ignore_missing boolean No When true, skip this processor if a source field is missing.
YAML 
- action: network_direction
  source_ip: attributes.source.ip
  destination_ip: attributes.destination.ip
  target_field: attributes.network.direction
  internal_networks:
    - "10.0.0.0/8"
    - "172.16.0.0/12"
    - "192.168.0.0/16"