Grouping IP addresses by site name

I am currently ingesting Apache logs through Filebeat via Logstash into ElasticSearch to create a data table in Kibana to display a list of all IP addresses which are trying to hit a certain resource.

Eg. in the apache access log, show how many times a client ip has requested '/images'.

At the moment, I have this working via a filter on the request field and the table appears as:
IP address, Count, 16000, 14000, 16731, 1

As we have multiple sites hitting our Apache server though, it is possible to group the IP addresses and label them as a site name?

Eg. and = site 1 and = site 2
So I could create a table like:
Site Name, Count
Site 1, 30000
Site 2, 16732

You could do this using a filter in the visualisation, see the help on this page for it -

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.