# Convert mapped IPv6 to IPv4
**URL:** https://discuss.elastic.co/t/convert-mapped-ipv6-to-ipv4/158651
**Category:** Logstash
**Created:** [November 28, 2018, 9:07pm UTC](https://discuss.elastic.co/t/convert-mapped-ipv6-to-ipv4/158651 "2018-11-28T21:07:22Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@nandrik](https://discuss.elastic.co/u/nandrik)
#### Post date: [November 28, 2018, 9:07pm UTC](https://discuss.elastic.co/t/convert-mapped-ipv6-to-ipv4/158651/1 "2018-11-28T21:07:22Z")
Hi, I have log lines from an IPv4 network.
However, in the log lines some of the IP addresses are mapped to`IPv6`, i.e. are in IPv6 format.
I wonder if there's a good way for those addresses to be **converted to `IPv4` format**.
Example of IPv4 address mapped in IPv6:
```auto
::ffff:a00:6
```
If you use any online [converter](https://www.vultr.com/tools/ipv4-converter/?ip_address=%3A%3Affff%3Aa00%3A6), you'll notice that this address translates to the following `IPv4` address:
```auto
10.0.0.6
```
I have no issue parsing the addresses since I can use multiple grok filters with `%{iPV6:srcIPv6}` and `%{IPV4:srcIPv4}` pattern types.
My ask is around how to convert the IPv6 format into an IPv4 one (same as the tool does).
I've seen in some posts ([example 1](https://discuss.elastic.co/t/converting-a-numeric-ipv4-address-to-dotted-format-string/121193)) where the use of a `ruby filter` is recommended.
Would appreciate your help.
---
### Author:  [@nandrik](https://discuss.elastic.co/u/nandrik)
#### Post date: [November 28, 2018, 9:28pm UTC](https://discuss.elastic.co/t/convert-mapped-ipv6-to-ipv4/158651/2 "2018-11-28T21:28:49Z")
Combining the [referenced ruby filter code](https://discuss.elastic.co/t/converting-a-numeric-ipv4-address-to-dotted-format-string/121193) with [Ruby conversion code](https://stackoverflow.com/questions/38984972/ruby-how-to-convert-ipv6-uo-address-to-ipv4-ip-address), I'm trying out the following piece of code in my filter:
```auto
if(![srcIPv4] and [srcIPv6]) {
mutate { add_field => { "srcIPv4" => ""}}
ruby {
init => 'require "ipaddr"'
code => '
ipv6 = IPAddr.new(event.get("srcIPv6"))
event.set("srcIPv4",ipv6.native)'
}
}
```
I've used a workaround using `[geoip][ip]` but I think I'm paying a high computational price for IPv6-to-IPv4 conversion.
The error that I'm getting in logstash's logs, because of this, is:
```auto
[2018-12-01T17:34:13,309][ERROR][logstash.filters.ruby] Ruby exception occurred: Missing Converter handling for full class name=org.jruby.RubyObjectVar2, simple name=RubyObjectVar2
```
And [a link with the Ruby code working in the tester](https://repl.it/repls/RegularInsubstantialDisks).
Any help appreciated, thanks!
---
### Author:  [@nandrik](https://discuss.elastic.co/u/nandrik)
#### Post date: [December 8, 2018, 11:47am UTC](https://discuss.elastic.co/t/convert-mapped-ipv6-to-ipv4/158651/3 "2018-12-08T11:47:54Z")
Any thoughts anyone?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 5, 2019, 11:47am UTC](https://discuss.elastic.co/t/convert-mapped-ipv6-to-ipv4/158651/4 "2019-01-05T11:47:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.