# Convert decimal string IP to ipv4 dotted decimal

**URL:** <https://discuss.elastic.co/t/convert-decimal-string-ip-to-ipv4-dotted-decimal/120476>\
**Category:** Logstash\
**Created:** [February 19, 2018, 3:05pm UTC](https://discuss.elastic.co/t/convert-decimal-string-ip-to-ipv4-dotted-decimal/120476 "2018-02-19T15:05:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![felixon](https://avatars.discourse-cdn.com/v4/letter/f/c77e96/32.png) [@felixon](https://discuss.elastic.co/u/felixon)\
**Post date:** [February 19, 2018, 3:05pm UTC](https://discuss.elastic.co/t/convert-decimal-string-ip-to-ipv4-dotted-decimal/120476/1 "2018-02-19T15:05:55Z")

</div>

Hi,

I am sending JSON formatted logs to my 5.4 Logstash.

I am using Json Filter Plugin.

**One of the JSON fields is Source\_IP, the point is that Source\_IP field is coming as decimal long number like "3105947710" (which in ipv4 fomat means 185.33.0.62).**

so eventually i am getting this JSON property:

> "Source\_IP": "3105947710"

I tried to use some "ruby code =\> " functions i found here in the forum but all came back with ruby error exceptions.

is there any way or logstash filter to convert this decimal IP address "3105947710" to IP4V dotted format "185.33.0.62"

I tired those methods but with no help, maybe i write somthing wrong:

> ruby {  
> code =\> 'event["ip\_as\_dotted\_quad"] = [event["your\_field\_here"].to\_i].pack("N").unpack("C4").join(".")'  
> }
> 
> ruby {  
> code =\> "require 'ipaddr' decimalip = event['Source\_IP'].abs event['ip'] = IPAddr.new(decimalip,Socket::AF\_INET).to\_s"  
> }

eventually i want to send and store in my elasticsearch index only the IPv4 dotted adresses converted.

thanks for the help

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 20, 2018, 8:26pm UTC](https://discuss.elastic.co/t/convert-decimal-string-ip-to-ipv4-dotted-decimal/120476/2 "2018-02-20T20:26:28Z")

</div>

You're using the wrong syntax for reading and writing field values. See [https://www.elastic.co/guide/en/logstash/current/event-api.html](https://www.elastic.co/guide/en/logstash/current/event-api.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2018, 8:26pm UTC](https://discuss.elastic.co/t/convert-decimal-string-ip-to-ipv4-dotted-decimal/120476/3 "2018-03-20T20:26:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.