Extract IP prefix

Reduces an IP address to the network it belongs to and publishes that value as a temporary variable.

Configuration	Content
Source: IP address	text field holding the address
Setting: Result	name under which the prefix is published; default: ip_prefix
Setting: IPv4	prefix length, default 32, maximum 32
Setting: IPv6	prefix length, default 64, maximum 128

The prefix is published under the key %<result>.prefix, with the label Prefix, present when the input address is valid. To write the prefix into the event, add a set field after the action, as described in Published results:

Actions:  Extract IP prefix: $ip_address, IPv6 /56        (result: ip_prefix)
          Set field: ip_network = %ip_prefix.prefix

The action exists because of IPv6. An IPv4 address identifies one access point. An IPv6 subscriber receives a whole range to use as it likes: a single connection can walk billions of addresses without repeating any of them. Counting individual IPv6 addresses counts nothing, because every attempt looks like it comes from a new visitor. Reducing the address to its prefix makes “attempts from this address” mean the same thing in both families.

The two lengths are configured separately, because a single number does not cover both families. The right aggregation depends on the traffic, not on the protocol: /64 is the standard residential range in IPv6, but a provider handing out /56 requires a wider prefix. An IPv4 estate behind NAT may justify grouping at /24.

The prefix comes out in CIDR notation. The /n suffix appears only when the address was actually reduced, so that a /32 and a /24 of the same address are never read as the same value. A malformed address publishes nothing.