Network layer IP spoofing (filter? mutate?)

Hi All,

I would like to see this feature implemented, where logstash can "Spoof" a Source IP address sent in the Network layer packet.

Is this hard to implement? I know that you can accomplish this using iptables on linux (and winpcap on windows) iptables is not the right solution though, because I need to apply logic (conditional statements) to the filter. Maybe this could be implemented into the "mutate" filter, or something similar.

The problem is device would identify all traffic coming from the logstash server instead of the originating host. The purpose of this feature would be so that other devices on the other side of the output pipe would see this as coming from the spoofed IP and not the actual IP of the logstash server.

This feature is present in a product called "Kiwi Syslog" (described at the bottom of this page http://www.kiwisyslog.com/help/syslog/index.html?action_forward_to_another_host.htm )

I'm working on a big proposal to replace Kiwi Syslog with ELK(B) stack, and this is a feature required