logstash-network-direction.rb

filter {
  cidr {
    add_tag => [ "local_source" ]
    address => [ "%{[source][ip]}" ]
    network => [ "10.0.0.0/8", "172.16.0.0/20", "192.168.0.0/16" ]
  }
  cidr {
    add_tag => [ "local_destination" ]
    address => [ "%{[destination][ip]}" ]
    network => [ "10.0.0.0/8", "172.16.0.0/20", "192.168.0.0/16" ]
  }
  
  if "local_source" in [tags] {
    if "local_destination" in [tags] {
      mutate {
        add_field => { [network][direction] => "internal" }
        remove_tag => [ "local_source", "local_destination" ]
      }
    } else {
      mutate {
        add_field => { [network][direction] => "outbound" }
        remove_tag => [ "local_source" ]
      }
    }
  } else {
    if "local_destination" in [tags] {
      mutate {
        add_field => { [network][direction] => "inbound" }
        remove_tag => [ "local_destination" ]
      }
    } else {
      mutate {
        add_field => { [network][direction] => "external" }
      }
    }
  }
}