# Change local ip address to "any text" in elasticsearch logs **URL:** \ **Category:** Logstash\ **Created:** [September 6, 2022, 9:14am UTC](https://discuss.elastic.co/t/change-local-ip-address-to-any-text-in-elasticsearch-logs/313771 "2022-09-06T09:14:41Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![kurdit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurdit/32/54994_2.png) [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Post date:** [September 6, 2022, 9:14am UTC](https://discuss.elastic.co/t/change-local-ip-address-to-any-text-in-elasticsearch-logs/313771/1 "2022-09-06T09:14:41Z")
hi all! we collect nginx access logs in elasticsearch. here is an example of incoming nginx access logs: `kibana-linux.elk.com 10.211.45.45 - [05/Sep/2022:15:26:54 +0300] UNIX-TIME-1662380814.467 "GET /internal/security/me HTTP/1.1" 200 "application/json; charset =utf-8" 353 "https://kibana-linux.elk.com/spaces/space_selector" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 " "sid=Fe26.2 **41173fd612c2c0c3ca13f7eeb955e7119efb3d7cfd73a11a29a0ac5c1aedbb24*Zw1pAvrGVFrpl2WwOXz2SQ*_CnHN5GfUYsBvk2qdAbKuB9OXsWfDxPjo9L6QdIIoF6WEcnA6AyjQF89naOGFEyverY_ujS4-MDc0FmEjtriiost-vJQknV47Eh75urCRd8eJwdUTXXtpd1d5XdH5Hqm5ypEPKQF-5cNgRLiZAbRpmY_puuGTGVeG9DtayRqwe3PCWEgaBM4c5CZG7saVIC3JdqpiDBJrsxcb06Yr6O-jWFHMAV7K8kFEk1P0fHDqX7BIdOf6nYEru** 206faeae4d13691521f2f15d275923e60d017c6f81972246f335a1433c29c8aa*ZOt5uqlaOxzEI0KI9bDgFLM2Q9ZPgzWF4XZNsxh4z4U" 0.100 "127.0.0.1:5601" NGINX-CACHE-- "5059c3a35ed5704a181a9226a1c3" "-"` in logstash I use the following pipeline and filter (I left only the necessary for an example): ```auto input { redis { host => "10.206.1.15" port => "6379" data_type => "list" type => "mylog" key => "mylog" codec => "plain" } } filter { if [type] == "mylog" { geoip { source => "remote_addr" target => "geoip" database => "/etc/logstash/GeoLite2-City.mmdb" } mutate { add_field => ["[geoip][country_reg_code]", "%{[geoip][geo][country_iso_code]}"] gsub => ["[geoip][country_reg_code]", "%{[geoip][geo][country_iso_code]}", "-" ] gsub => ["[geoip][country_reg_code]", "-%{[geoip][geo][region_code]}", "-" ] } } } output { if [type] == "mylog" { elasticsearch { ....... } } } ``` using Geoip filter plugin [Geoip filter plugin | Logstash Reference [8.4] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html) this works fine with the "global" addresses that are in the GeoLite2-City.mmdb database, but in my logs there are also local IP addresses like 10.211.45.45, 172.17.1.172, etc. because these addresses are not in the GeoLite2-City.mmdb database, then instead of geoip.country\_reg\_code, the gsub part from the logstash is supplied, namely "%{[geoip][geo][country\_iso\_code]}" ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/5/256e7de589abc7be2afca06224e1bd4567850bf8.png) what condition (expression) in the logstash pipeline do I need to write in order to fulfill the following condition: if there is no local IP address in the GeoLite2-City.mmdb database, then in this field instead of the gsub part from the logstash, you must specify either the IP address itself, or specify the text "local IP address" ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [September 6, 2022, 12:31pm UTC](https://discuss.elastic.co/t/change-local-ip-address-to-any-text-in-elasticsearch-logs/313771/2 "2022-09-06T12:31:34Z")
You should test if the field `[geoip][geo][country_iso_code]` exists before your mutate. Something like this: ```auto if [geoip][geo][country_iso_code] { mutate { add_field => { "[geoip][country_reg_code]" => "%{[geoip][geo][country_iso_code]}" } } } else { mutate { add_field => { "[geoip][country_reg_code]" => "local IP address" } } } ``` ---
**Author:** ![kurdit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurdit/32/54994_2.png) [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Post date:** [September 6, 2022, 2:04pm UTC](https://discuss.elastic.co/t/change-local-ip-address-to-any-text-in-elasticsearch-logs/313771/3 "2022-09-06T14:04:13Z")
thanks, I applied your recommendation, but now the field `geoip.country_reg_code` looks like this ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e5a6d6975ad695d489e8c6054c3c078150306aa8.png) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [September 6, 2022, 3:38pm UTC](https://discuss.elastic.co/t/change-local-ip-address-to-any-text-in-elasticsearch-logs/313771/4 "2022-09-06T15:38:56Z")
Did you remove the other mutate? What is the configuration you are using now? ---
**Author:** ![kurdit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurdit/32/54994_2.png) [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Post date:** [September 6, 2022, 3:55pm UTC](https://discuss.elastic.co/t/change-local-ip-address-to-any-text-in-elasticsearch-logs/313771/5 "2022-09-06T15:55:33Z")
no, didn’t delete the other mutate. need to remove it? now my pipeline.conf looks like this ```auto input { redis { host => "10.206.1.15" port => "6379" data_type => "list" type => "mylog" key => "mylog" codec => "plain" } } filter { if [type] == "mylog" { geoip { source => "remote_addr" target => "geoip" database => "/etc/logstash/GeoLite2-City.mmdb" } mutate { add_field => ["[geoip][country_reg_code]", "%{[geoip][geo][country_iso_code]}"] gsub => ["[geoip][country_reg_code]", "%{[geoip][geo][country_iso_code]}", "-" ] gsub => ["[geoip][country_reg_code]", "-%{[geoip][geo][region_code]}", "-" ] } } if [geoip][geo][country_iso_code] { mutate { add_field => { "[geoip][country_reg_code]" => "%{[geoip][geo][country_iso_code]}" } } } else { mutate { add_field => { "[geoip][country_reg_code]" => "local IP address" } } } } output { if [type] == "mylog" { elasticsearch { ....... } } } ``` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [September 6, 2022, 4:59pm UTC](https://discuss.elastic.co/t/change-local-ip-address-to-any-text-in-elasticsearch-logs/313771/6 "2022-09-06T16:59:22Z")
That's the issue then, if you do not remove the other mutate you will keep getting this value since you are not checking if the field exist or not. You need to have something like this: ```auto filter { if [type] == "mylog" { geoip { source => "remote_addr" target => "geoip" database => "/etc/logstash/GeoLite2-City.mmdb" } if [geoip][geo][country_iso_code] { mutate { add_field => { "[geoip][country_reg_code]" => "%{[geoip][geo][country_iso_code]}" } } } else { mutate { add_field => { "[geoip][country_reg_code]" => "local IP address" } } } } } ``` ---
**Author:** ![kurdit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurdit/32/54994_2.png) [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Post date:** [September 6, 2022, 10:36pm UTC](https://discuss.elastic.co/t/change-local-ip-address-to-any-text-in-elasticsearch-logs/313771/7 "2022-09-06T22:36:54Z")
thanks for the help, deleting the first mutate really helped (I was afraid to delete it) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 4, 2022, 10:37pm UTC](https://discuss.elastic.co/t/change-local-ip-address-to-any-text-in-elasticsearch-logs/313771/8 "2022-10-04T22:37:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.