# Convert decimal IP to ipv4 dotted decimal

**URL:** https://discuss.elastic.co/t/convert-decimal-ip-to-ipv4-dotted-decimal/68109
**Category:** Logstash
**Created:** [December 5, 2016, 10:47pm UTC](https://discuss.elastic.co/t/convert-decimal-ip-to-ipv4-dotted-decimal/68109 "2016-12-05T22:47:24Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Geezer](https://avatars.discourse-cdn.com/v4/letter/g/49beb7/32.png) [@Geezer](https://discuss.elastic.co/u/Geezer)
#### Post date: [December 5, 2016, 10:47pm UTC](https://discuss.elastic.co/t/convert-decimal-ip-to-ipv4-dotted-decimal/68109/1 "2016-12-05T22:47:24Z")

</div>

Hello,

I am reading data from an SQL table which contains IP addresses in decimal format, and I need to convert these to dotted decimal. e.g.

convert this: 1978211278  
to this: 117.233.27.206

I am trying to do this with a Ruby filter using the ipaddr method:

```
		if [sourceipv4] {
			ruby{
				code => "require 'ipaddr'
						decimalip = event['sourceipv4']
						event['ip'] = IPAddr.new('decimalip',Socket::AF_INET).to_s()"
			}
		}

```

...where sourceipv4 is my decimal ip address, but this gives me this error:

{:timestamp=\>"2016-12-05T14:41:55.019000-0800", :message=\>"Ruby exception occurred: address family mismatch", :level=\>:error}  
{:timestamp=\>"2016-12-05T14:41:55.020000-0800", :message=\>"Ruby exception occurred: address family mismatch", :level=\>:error}  
{:timestamp=\>"2016-12-05T14:41:55.020000-0800", :message=\>"Ruby exception occurred: address family mismatch", :level=\>:error

Can anyone assist please?

Thank you

---

<div class="post-metadata">

### Author: ![Geezer](https://avatars.discourse-cdn.com/v4/letter/g/49beb7/32.png) [@Geezer](https://discuss.elastic.co/u/Geezer)
#### Post date: [December 5, 2016, 10:56pm UTC](https://discuss.elastic.co/t/convert-decimal-ip-to-ipv4-dotted-decimal/68109/2 "2016-12-05T22:56:51Z")

</div>

Found the problem. I had some extra single quotes, and the integers were negative so I had to drop the minus sign.

This version works:

```
		if [sourceipv4] {
			ruby{
				code => "require 'ipaddr'
						decimalip = event['sourceipv4'].abs
						event['ip'] = IPAddr.new(decimalip,Socket::AF_INET).to_s"
			}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 2, 2017, 10:57pm UTC](https://discuss.elastic.co/t/convert-decimal-ip-to-ipv4-dotted-decimal/68109/3 "2017-01-02T22:57:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
