# Best practice for an "IP Check"
**URL:** https://discuss.elastic.co/t/best-practice-for-an-ip-check/186000
**Category:** Elasticsearch
**Created:** [June 17, 2019, 6:26am UTC](https://discuss.elastic.co/t/best-practice-for-an-ip-check/186000 "2019-06-17T06:26:34Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)
#### Post date: [June 17, 2019, 6:26am UTC](https://discuss.elastic.co/t/best-practice-for-an-ip-check/186000/1 "2019-06-17T06:26:34Z")
Dear all,
I am trying to realise a scenario and want to ask you, how this would be made best. The scenario looks like this:
We are logging our firewalls via logstash / grok patterns and store the logs in elastic. On the other side we have a list of thousands "bad ips". This list can be just simple in a text file, or could also be get from a database. What we now want to do is to check continously, if a connection goes to any of these thousands of bad IPs and if it does, we want to be informed. Bad thing, we don't have the alerting license, only a basic license.
How would you solve this problem?
Cheers,
Marcus
---
### Author:  [@vasek](https://discuss.elastic.co/u/vasek)
#### Post date: [June 17, 2019, 8:05am UTC](https://discuss.elastic.co/t/best-practice-for-an-ip-check/186000/2 "2019-06-17T08:05:39Z")
Hi,
for detecting IP that is on blacklist - you can use Logstash and [filter plugin Translate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html).
For alerting you can use
1. [Elastalert](https://github.com/Yelp/elastalert) - configurable by admins on server (config files)
2. [Sentinl](https://github.com/sirensolutions/sentinl) - Can be integrated to Kibana but you won't be able to keep up with the latest version of Elasticsearch.
3. [Logstash output nagios\_nsca plugin](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-nagios_nsca.html) - some version had problem with working
4. Custom script (e.g. Shell) with knowledge of [Elasticsearch Query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl.html) - you'll have to program logic of alerting (repeating alerts - silents, etc.)
X-Pack feature will you save a lot of time. Furthermore it is integrated to Kibana UI.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 15, 2019, 8:05am UTC](https://discuss.elastic.co/t/best-practice-for-an-ip-check/186000/3 "2019-07-15T08:05:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.