# External file for match

**URL:** <https://discuss.elastic.co/t/external-file-for-match/98663>\
**Category:** Logstash\
**Created:** [August 29, 2017, 10:08am UTC](https://discuss.elastic.co/t/external-file-for-match/98663 "2017-08-29T10:08:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexander\_Orlenko](https://avatars.discourse-cdn.com/v4/letter/a/57b2e6/32.png) [@Alexander\_Orlenko](https://discuss.elastic.co/u/Alexander_Orlenko)\
**Post date:** [August 29, 2017, 10:08am UTC](https://discuss.elastic.co/t/external-file-for-match/98663/1 "2017-08-29T10:08:45Z")

</div>

Hello,

We analise syslog msg from dhcpd daemon.  
And want use GeoIP, but we use internal ip addresses.  
How match internal ip or host name to City.

For example,  
@timestamp August 29th 2017, 12:39:10.754  
host 172.xx.xx.x  
host\_name krg2-fw  
message \<190\> 2017 Aug 29 11:37:59 krg2-fw [local7.info](http://local7.info) dhcpd: [Local Network: DHCP] DHCPACK on 10.x.x.x to 68:f7:xx:xx (xxx) via LAN1  
srcip 10.x.x.x

172.xx.xx.x = krg2-fw = \>Krasnodar  
How match interlan IP or hostname with City?

The city name over 150.  
We have two way.

1. Edit geoip DB manual
2. use external csv (txt etc) file, where match hostname or ip with City

How can do this ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 29, 2017, 2:31pm UTC](https://discuss.elastic.co/t/external-file-for-match/98663/2 "2017-08-29T14:31:38Z")

</div>

Look into the translate filter.

---

<div class="post-metadata">

**Author:** ![Alexander\_Orlenko](https://avatars.discourse-cdn.com/v4/letter/a/57b2e6/32.png) [@Alexander\_Orlenko](https://discuss.elastic.co/u/Alexander_Orlenko)\
**Post date:** [August 30, 2017, 1:15pm UTC](https://discuss.elastic.co/t/external-file-for-match/98663/3 "2017-08-30T13:15:15Z")

</div>

thanks Magnus  
Sorry for delay answer, need quick implement 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2017, 1:15pm UTC](https://discuss.elastic.co/t/external-file-for-match/98663/4 "2017-09-27T13:15:21Z")

</div>

Closed on September 27, 2017, 1:15pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.