# Filtering IPs with Grok
**URL:** https://discuss.elastic.co/t/filtering-ips-with-grok/134296
**Category:** Logstash
**Created:** [June 2, 2018, 6:36pm UTC](https://discuss.elastic.co/t/filtering-ips-with-grok/134296 "2018-06-02T18:36:23Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@nin77](https://discuss.elastic.co/u/nin77)
#### Post date: [June 2, 2018, 6:36pm UTC](https://discuss.elastic.co/t/filtering-ips-with-grok/134296/1 "2018-06-02T18:36:24Z")
Hello, I want to filter apache access logs before giving them to elastic search. I want to filter specific IPs and remove the lines where the IPs dont occur. But at the moment I am struggeling with the grok filter.
I am using Grok Debugger with the pattern %{IPV4:ip} which is able to get me one single IP from one input line. Is Grok Debugger able to work with multiple lines?
How do I search for specific IP(s) and remove the other lines?
Thanks a lot!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 3, 2018, 8:21pm UTC](https://discuss.elastic.co/t/filtering-ips-with-grok/134296/2 "2018-06-03T20:21:22Z")
> I am using Grok Debugger with the pattern %{IPV4:ip} which is able to get me one single IP from one input line. Is Grok Debugger able to work with multiple lines?
Yes, if the input lines are joined into a single Logstash event but that's not something you'll want to do with an access log. Process the lines one by one.
> How do I search for specific IP(s) and remove the other lines?
Capture the IP address into a field. If you only have a small number of IP addresses to whitelist (say, single digit) you can just wrap a drop filter in a conditional that compares the IP address field against a fixed list of IP addresses, otherwise use a translate filter to look up the field with the IP address against the contents of a file.
---
### Author:  [@azhar](https://discuss.elastic.co/u/azhar)
#### Post date: [June 3, 2018, 10:13pm UTC](https://discuss.elastic.co/t/filtering-ips-with-grok/134296/3 "2018-06-03T22:13:26Z")
Yes, it is possible with the mutliline codec provided built in. Check this out [https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 1, 2018, 10:13pm UTC](https://discuss.elastic.co/t/filtering-ips-with-grok/134296/4 "2018-07-01T22:13:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.