# Grouping IP addresses by site name

**URL:** <https://discuss.elastic.co/t/grouping-ip-addresses-by-site-name/112285>\
**Category:** Kibana\
**Created:** [December 18, 2017, 5:39pm UTC](https://discuss.elastic.co/t/grouping-ip-addresses-by-site-name/112285 "2017-12-18T17:39:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![c\_dev](https://avatars.discourse-cdn.com/v4/letter/c/b38774/32.png) [@c\_dev](https://discuss.elastic.co/u/c_dev)\
**Post date:** [December 18, 2017, 5:39pm UTC](https://discuss.elastic.co/t/grouping-ip-addresses-by-site-name/112285/1 "2017-12-18T17:39:20Z")

</div>

I am currently ingesting Apache logs through Filebeat via Logstash into ElasticSearch to create a data table in Kibana to display a list of all IP addresses which are trying to hit a certain resource.

Eg. in the apache access log, show how many times a client ip has requested '/images'.

At the moment, I have this working via a filter on the request field and the table appears as:  
IP address, Count  
10.10.10.1, 16000  
10.10.11.2, 14000  
20.20.20.1, 16731  
20.20.21.2, 1

As we have multiple sites hitting our Apache server though, it is possible to group the IP addresses and label them as a site name?

Eg. 10.10.10.1 and 10.10.11.2 = site 1  
20.20.20.1 and 20.20.21.2 = site 2  
So I could create a table like:  
Site Name, Count  
Site 1, 30000  
Site 2, 16732

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 19, 2017, 7:59am UTC](https://discuss.elastic.co/t/grouping-ip-addresses-by-site-name/112285/2 "2017-12-19T07:59:13Z")

</div>

You could do this using a filter in the visualisation, see the help on this page for it - [https://www.elastic.co/guide/en/kibana/current/pie-chart.html](https://www.elastic.co/guide/en/kibana/current/pie-chart.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 16, 2018, 7:59am UTC](https://discuss.elastic.co/t/grouping-ip-addresses-by-site-name/112285/3 "2018-01-16T07:59:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.