Add Remote IP address in winlogbeat data

Elastic Stack Logstash
1

Hi,

I have added the below mutate filter for adding IP address in winlogbeat index.

mutate{
add_field => { "remote_ip" => "%{[@metadata][ip_address]}" }
}

But it's not getting the output as expected. It's showing like this- "remote_ip": "%{[@metadata][ip_address]}",

Can someone please help me to solve this.

2

I don't believe Winlogbeat adds the IP address of the host in the [@metadata][ip_address] field.

3

Thanks for your reply.

now I am getting only the hostname. How can I get the IP address? Can you please shed some light on this.

4

Have a look at the dns filter.