Add field "remote_ip" if message contains ip addr

Elastic Stack Logstash
#1

Hello all.

I am trying to add a new field if an ip addr is in the message field. Something like that.

filter {
  grok {
    match => { "message" => "%{IP:client} }
    add_field => { "remote_ip" => "%{client}" }
  }
}

Someone has a hint for me to accomplish that?

thanks and cheers

#2

Got it working with:

filter {
    grok {
        match => [ "message", "%{IP:client}" ]
    }
    mutate {
        add_field => [ "remote_ip", "%{client}" ]
    }
    if ("_grokparsefailure" in [tags]) { drop {} }
}
#3

Why capture to the client field and then copy that into the remote_ip field? Why not capture into remote_ip directly?

#4

Hi Magnus.

Thanks for your answer. You are right. With my example i had two new fields. I wasn't aware of the fact capturing leeds to a new field.

cheers
t.

#5