Get ip source TCP plugin

Elastic Stack Logstash
1

Hi,

I wonder if it's possible to get the ip source of a sender when using tcp input in logstash.

Is there a way to get this ip even if I don't use http requests ?

Best regards,

Thomas R.

2

Hello Thomas,

Have a look here. By default, the tcp input tries to resolve IPs to hostnames but this can be disabled by setting dns_reverse_lookup_enabledto false. This way you can access the IP using @metadata.

Best regards
Wolfram