# Add field "remote\_ip" if message contains ip addr

**URL:** <https://discuss.elastic.co/t/add-field-remote-ip-if-message-contains-ip-addr/61225>\
**Category:** Logstash\
**Created:** [September 22, 2016, 9:33am UTC](https://discuss.elastic.co/t/add-field-remote-ip-if-message-contains-ip-addr/61225 "2016-09-22T09:33:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![himbeere](https://avatars.discourse-cdn.com/v4/letter/h/db5fbb/32.png) [@himbeere](https://discuss.elastic.co/u/himbeere)\
**Post date:** [September 22, 2016, 9:33am UTC](https://discuss.elastic.co/t/add-field-remote-ip-if-message-contains-ip-addr/61225/1 "2016-09-22T09:33:05Z")

</div>

Hello all.

I am trying to add a new field if an ip addr is in the message field. Something like that.

```auto
filter {
  grok {
    match => { "message" => "%{IP:client} }
    add_field => { "remote_ip" => "%{client}" }
  }
}

```

Someone has a hint for me to accomplish that?

thanks and cheers

---

<div class="post-metadata">

**Author:** ![himbeere](https://avatars.discourse-cdn.com/v4/letter/h/db5fbb/32.png) [@himbeere](https://discuss.elastic.co/u/himbeere)\
**Post date:** [September 22, 2016, 9:45am UTC](https://discuss.elastic.co/t/add-field-remote-ip-if-message-contains-ip-addr/61225/2 "2016-09-22T09:45:36Z")

</div>

Got it working with:

```auto
filter {
    grok {
        match => ["message", "%{IP:client}"]
    }
    mutate {
        add_field => ["remote_ip", "%{client}"]
    }
    if ("_grokparsefailure" in [tags]) { drop {} }
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 22, 2016, 10:29am UTC](https://discuss.elastic.co/t/add-field-remote-ip-if-message-contains-ip-addr/61225/3 "2016-09-22T10:29:26Z")

</div>

Why capture to the `client` field and then copy that into the `remote_ip` field? Why not capture into `remote_ip` directly?

---

<div class="post-metadata">

**Author:** ![himbeere](https://avatars.discourse-cdn.com/v4/letter/h/db5fbb/32.png) [@himbeere](https://discuss.elastic.co/u/himbeere)\
**Post date:** [September 22, 2016, 10:47am UTC](https://discuss.elastic.co/t/add-field-remote-ip-if-message-contains-ip-addr/61225/4 "2016-09-22T10:47:45Z")

</div>

Hi Magnus.

Thanks for your answer. You are right. With my example i had two new fields. I wasn't aware of the fact capturing leeds to a new field.

cheers  
t.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:37am UTC](https://discuss.elastic.co/t/add-field-remote-ip-if-message-contains-ip-addr/61225/5 "2017-07-06T04:37:22Z")

</div>

Closed on July 6, 2017, 4:37am UTC