# Efficient way to determine IP version (v4 vs. v6)?

**URL:** https://discuss.elastic.co/t/efficient-way-to-determine-ip-version-v4-vs-v6/167334
**Category:** Logstash
**Created:** [February 6, 2019, 5:08pm UTC](https://discuss.elastic.co/t/efficient-way-to-determine-ip-version-v4-vs-v6/167334 "2019-02-06T17:08:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![SpeedDaemon](https://avatars.discourse-cdn.com/v4/letter/s/4af34b/32.png) [@SpeedDaemon](https://discuss.elastic.co/u/SpeedDaemon)
#### Post date: [February 6, 2019, 5:08pm UTC](https://discuss.elastic.co/t/efficient-way-to-determine-ip-version-v4-vs-v6/167334/1 "2019-02-06T17:08:53Z")

</div>

Is there an efficient way in a Logstash pipeline to take a field with an IP in it, and determine whether that IP is v4 or v6?

The only way I can think to do it would involve at least two groks per IP (four per doc for source and dest), plus a lot of checking if tags/fields exist and then removing them later. This pipeline needs to sustain about 10,000 documents/second, so efficiency is important.

All I need is to know if the IP is v6, so I can skip a section of the pipeline that errors out with v6 IPs. A very small percentage of the documents have v6 IPs.

(I suppose I could hack it by just checking for the existence of ":" in the IP field, but it seems like this should be an easy thing to do "properly")

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 6, 2019, 6:01pm UTC](https://discuss.elastic.co/t/efficient-way-to-determine-ip-version-v4-vs-v6/167334/2 "2019-02-06T18:01:19Z")

</div>

I don't think you need two groks per IP. If it is not V6 then it is going to be V4, right?

Personally I would do this by checking for a colon in the address. I don't think that is a hack.

---

<div class="post-metadata">

### Author: ![SpeedDaemon](https://avatars.discourse-cdn.com/v4/letter/s/4af34b/32.png) [@SpeedDaemon](https://discuss.elastic.co/u/SpeedDaemon)
#### Post date: [February 6, 2019, 6:40pm UTC](https://discuss.elastic.co/t/efficient-way-to-determine-ip-version-v4-vs-v6/167334/3 "2019-02-06T18:40:12Z")

</div>

Yeah, leaning towards checking for :  
Going to try a ruby filter to avoid regexes/grok

```auto
ruby {
  code =>"
  event['src.isv6'] = ( event['src.ip'][0,5][':'] == ":" )
  "
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 6, 2019, 6:40pm UTC](https://discuss.elastic.co/t/efficient-way-to-determine-ip-version-v4-vs-v6/167334/4 "2019-03-06T18:40:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.