remove datadog ip addresses from flow log records

filter-datadog-ips

#!/usr/bin/env python3
import json
import sys

import urllib3
from ipaddress import ip_network, IPv4Network, ip_address

http = urllib3.PoolManager()


def data_dog_ip_ranges() -> [IPv4Network]:
    response = http.request(
        "GET",
        "https://ip-ranges.datadoghq.com/",
        headers={"Accept-Content": "application/json"},
    )
    ip_ranges = json.loads(response.data)
    return [
        ip_network(prefix)
        for v in ip_ranges.values()
        if isinstance(v, dict) and "prefixes_ipv4" in v
        for prefix in v["prefixes_ipv4"]
        if prefix
    ]


def filter_flow_logs(networks):
    for line in sys.stdin:
        record = line.strip().split(" ")

        dstaddr = record[4] if len(record) > 4 else None
        try:
            dst = ip_address(dstaddr)
        except ValueError:
            dst = None

        if dst and any(ip_address(dst) in network for network in networks):
            pass
        else:
            sys.stdout.write(line)


if __name__ == "__main__":
    filter_flow_logs(data_dog_ip_ranges())