# How do I get Internal original IP addresses of the devices from router logs

**URL:** <https://discuss.elastic.co/t/how-do-i-get-internal-original-ip-addresses-of-the-devices-from-router-logs/361934>\
**Category:** Logstash\
**Created:** [June 24, 2024, 8:19am UTC](https://discuss.elastic.co/t/how-do-i-get-internal-original-ip-addresses-of-the-devices-from-router-logs/361934 "2024-06-24T08:19:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Md\_Wahid\_Sadiq\_Ratul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/md_wahid_sadiq_ratul/32/135491_2.png) [@Md\_Wahid\_Sadiq\_Ratul](https://discuss.elastic.co/u/Md_Wahid_Sadiq_Ratul)\
**Post date:** [June 24, 2024, 8:19am UTC](https://discuss.elastic.co/t/how-do-i-get-internal-original-ip-addresses-of-the-devices-from-router-logs/361934/1 "2024-06-24T08:19:09Z")

</div>

I am a new learner of the ELK stack. I am taking logs from the router using SNMP and UDP protocol. But I am only getting Post Nat IPV4 addresses. I am including the config code here.

```auto
input {
  snmptrap {
    port => 162 # SNMP trap port
    community => "public" # SNMP community string
    type => "snmptrap" # Event type
  }
  
  udp {
    port => 2055 # NetFlow port
    codec => netflow {
      versions => [5, 9, 10] # NetFlow versions to support
    }
    type => "netflow" # Event type
  }
}

filter {
  if [type] == "snmptrap" {
    grok {
      match => { "message" => "%{WORD:snmp_version}\s*=%{INT:snmp_version_number};\s*%{WORD:snmp_community}\s*=%{DATA:snmp_community_string};\s*%{WORD:snmp_type}\s*=%{WORD:snmp_trap_type};\s*%{WORD:snmp_trap_oid}\s*=%{DATA:snmp_trap_oid};\s*%{WORD:snmp_trap_ip}\s*=%{IP:snmp_trap_source_ip};\s*%{WORD:snmp_trap_enterprise}\s*=%{DATA:snmp_trap_enterprise};\s*%{WORD:snmp_trap_timestamp}\s*=%{DATA:snmp_trap_timestamp};\s*%{WORD:snmp_trap_vars}\s*=%{GREEDYDATA:snmp_trap_variables}" }
    }
    date {
      match => ["snmp_trap_timestamp", "UNIX"]
      target => "@timestamp"
    }
    mutate {
      remove_field => ["snmp_trap_timestamp", "message"]
    }
  }

  # Define internal networks
  cidr {
    add_tag => ["internal"]
    address => ["%{[netflow][source_ipv4_address]}", "%{[netflow][destination_ipv4_address]}" ]
    network => ["192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12"] # Add other internal networks as needed
  }

  if "internal" in [tags] {
    mutate {
      add_field => { "network_type" => "internal" }
    }
  } else {
    mutate {
      add_field => { "network_type" => "external" }
    }
  }
}

output {
  elasticsearch {
    hosts => ["https://192.168.200.45:9200"]
    index => "snmp_netflow_data"
    ssl => true
    cacert => "/etc/logstash/conf.d/http_ca.crt"
    user => "elastic"
    password => "12345678"
  }
  
  stdout {
    codec => rubydebug
  }
}

```

 ![routerlog2](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8e1e5591145221a3f7968b258beec36a38073205.png)