# Filebeat host ip address in Logstash

**URL:** https://discuss.elastic.co/t/filebeat-host-ip-address-in-logstash/37655
**Category:** Beats
**Created:** [December 20, 2015, 11:55pm UTC](https://discuss.elastic.co/t/filebeat-host-ip-address-in-logstash/37655 "2015-12-20T23:55:39Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![sqshq](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@sqshq](https://discuss.elastic.co/u/sqshq)
#### Post date: [December 20, 2015, 11:55pm UTC](https://discuss.elastic.co/t/filebeat-host-ip-address-in-logstash/37655/1 "2015-12-20T23:55:40Z")

</div>

Hello,

I've configured Filebeat on application host and ELK stack on another. Everything working good, but i have just beat.hostname and [beat.name](http://beat.name) fileds in Logstash.

Is there a way to retrieve IP address of my application host?

---

<div class="post-metadata">

### Author: ![monica](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/monica/32/3696_2.png) [@monica](https://discuss.elastic.co/u/monica)
#### Post date: [December 22, 2015, 1:50pm UTC](https://discuss.elastic.co/t/filebeat-host-ip-address-in-logstash/37655/2 "2015-12-22T13:50:01Z")

</div>

Currently Filebeat doesn't export the IP address, but you can configure Filebeat to add an additional field that contains a static IP address that you configure in each configuration file. Please check [fields option](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#configuration-fields).

fields:  
ip\_address: 192.168.3.4

If this doesn't help you, feel free to open a new feature request [here](https://github.com/elastic/beats/issues).

---

<div class="post-metadata">

### Author: ![siva\_kumar1](https://avatars.discourse-cdn.com/v4/letter/s/a9a28c/32.png) [@siva\_kumar1](https://discuss.elastic.co/u/siva_kumar1)
#### Post date: [June 7, 2016, 11:19am UTC](https://discuss.elastic.co/t/filebeat-host-ip-address-in-logstash/37655/3 "2016-06-07T11:19:19Z")

</div>

Hi Monica,  
How do i access this custom variable ip\_address on logstash end?

Thanks

---

<div class="post-metadata">

### Author: ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [June 8, 2016, 8:10am UTC](https://discuss.elastic.co/t/filebeat-host-ip-address-in-logstash/37655/4 "2016-06-08T08:10:35Z")

</div>

You should be able to access in the same way as any other field with `fields.ip_address`.

---

<div class="post-metadata">

### Author: ![siva\_kumar1](https://avatars.discourse-cdn.com/v4/letter/s/a9a28c/32.png) [@siva\_kumar1](https://discuss.elastic.co/u/siva_kumar1)
#### Post date: [June 8, 2016, 8:44am UTC](https://discuss.elastic.co/t/filebeat-host-ip-address-in-logstash/37655/5 "2016-06-08T08:44:03Z")

</div>

Hi ruflin,  
I am new to filebeat and logstash, i tried the following and i get an exception on logstash end  
logstash configuration:  
`input { beats { port => 5044 type =>trial samplevar => fields.portvariable } }`

portvariable i am passing from filebeat. In anycase logstash throwing exception, saying invalid config. Please lmk what is wrong with the config

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [June 8, 2016, 11:28am UTC](https://discuss.elastic.co/t/filebeat-host-ip-address-in-logstash/37655/6 "2016-06-08T11:28:51Z")

</div>

1. accessing variables in logstash is via `[fields][portvariable]`
2. what's samplevar option in beat input plugin? This config option is not supported by logstash

See logstash config docs + ongoing sub-chapters for logstash config file syntax: [https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html](https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html)

For manipulating events check out the docs filters section.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:51pm UTC](https://discuss.elastic.co/t/filebeat-host-ip-address-in-logstash/37655/7 "2017-07-05T21:51:15Z")

</div>


