Parsing two IP in single field

[Rached1996]

Hello Community 
I'm working on a custom parser and i see that the ip in the raw log is in this format :

"AUDIT_SOURCE_IP": "147.1.1.1,34.1.1.7",

As you see two IP's in single field and getting this error while parsing :

generic::unknown: invalid event 0: LOG_PARSING_GENERATED_INVALID_EVENT: "field type check failed: field backstory.Noun.ip[0] \""147.1.1.1,34.1.1.7\" does not match type IP: invalid argument" 

how i can resolve that please ?

[TomAtGoogle · Accepted solution]

This one is actually pretty simple.  Just iterate through the IP list and add them to the UDM field one at a time.

if [IP] != "" {
     for myIP in AUDIT_SOURCE_IP {
          mutate {
               merge => {
                    "event.idm.read_only_udm.principal.ip" => "%[myIP]"
               }
               on_error => "zerror.no_principal_ip"
          }
     }
}