# Extract IP from multiple lines

**URL:** <https://discuss.elastic.co/t/extract-ip-from-multiple-lines/118910>\
**Category:** Logstash\
**Created:** [February 7, 2018, 7:11pm UTC](https://discuss.elastic.co/t/extract-ip-from-multiple-lines/118910 "2018-02-07T19:11:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dvi\_469](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dvi_469/32/59295_2.png) [@dvi\_469](https://discuss.elastic.co/u/dvi_469)\
**Post date:** [February 7, 2018, 7:11pm UTC](https://discuss.elastic.co/t/extract-ip-from-multiple-lines/118910/1 "2018-02-07T19:11:34Z")

</div>

Using ELK 5.6  
Filebeat ships a log to Logstash that looks like this:  
1.1.1.1  
2.2.2.2  
3.3.3.3  
etc.  
What would be the best way to extract each IP address and put it into its own field, like peer1, peer2, peer3, etc...? (The field would have to be created dynamically since the number of lines will change)  
If I use %{IPV4:peer} grok, it only prints the first line:  
{  
"peer": [  
[  
"1.1.1.1"  
]  
]  
}  
Thank you for any tips.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 7, 2018, 8:59pm UTC](https://discuss.elastic.co/t/extract-ip-from-multiple-lines/118910/2 "2018-02-07T20:59:58Z")

</div>

You want all IP addresses in the same document in ES? Then you need to use Filebeat's multiline feature to join the lines in the file to a single event before shipping to Logstash.

---

<div class="post-metadata">

**Author:** ![dvi\_469](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dvi_469/32/59295_2.png) [@dvi\_469](https://discuss.elastic.co/u/dvi_469)\
**Post date:** [February 7, 2018, 9:04pm UTC](https://discuss.elastic.co/t/extract-ip-from-multiple-lines/118910/3 "2018-02-07T21:04:14Z")

</div>

So, if I have a log file (yes, same document in ES) with one line like this:  
1.1.1.1,2.2.2.2,3.3.3.3  
What would the grok filter look like? Considering fields would have to be created dynamically.  
Thanks Magnus.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 7, 2018, 9:12pm UTC](https://discuss.elastic.co/t/extract-ip-from-multiple-lines/118910/4 "2018-02-07T21:12:46Z")

</div>

If you want to use a grok filter you'd have to enumerate all fields you want to capture,

```
%{IPV4:peer1},%{IPV4:peer2},...

```

or the equivalent with a csv filter (you don't need grok in this simple case) and if that's not desirable you could use a mutate filter's split option to turn the input string into an array that a ruby filter can read and dynamically turn into any number of fields.

---

<div class="post-metadata">

**Author:** ![dvi\_469](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dvi_469/32/59295_2.png) [@dvi\_469](https://discuss.elastic.co/u/dvi_469)\
**Post date:** [February 7, 2018, 9:15pm UTC](https://discuss.elastic.co/t/extract-ip-from-multiple-lines/118910/5 "2018-02-07T21:15:28Z")

</div>

Got it. Thank you very much for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 7, 2018, 9:15pm UTC](https://discuss.elastic.co/t/extract-ip-from-multiple-lines/118910/6 "2018-03-07T21:15:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.