# How to add client.ip to Alarm "stack by"?

**URL:** <https://discuss.elastic.co/t/how-to-add-client-ip-to-alarm-stack-by/302171>\
**Category:** SIEM\
**Created:** [April 12, 2022, 1:40am UTC](https://discuss.elastic.co/t/how-to-add-client-ip-to-alarm-stack-by/302171 "2022-04-12T01:40:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![VellayLoket](https://avatars.discourse-cdn.com/v4/letter/v/13edae/32.png) [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)\
**Post date:** [April 12, 2022, 1:40am UTC](https://discuss.elastic.co/t/how-to-add-client-ip-to-alarm-stack-by/302171/1 "2022-04-12T01:40:05Z")

</div>

In the "Alerts" section, in the "Stack by" field, I see many fields other than the one I need (client.ip). How to add a field to this list?

---

<div class="post-metadata">

**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\
**Post date:** [April 12, 2022, 1:12pm UTC](https://discuss.elastic.co/t/how-to-add-client-ip-to-alarm-stack-by/302171/2 "2022-04-12T13:12:43Z")

</div>

What version are you on @VellayLoket? Looks like this was changed to a free field selection in `8.1`, so from that version forward you can just type whichever field you want 🙂

 ![Alerts_-_Kibana](https://us1.discourse-cdn.com/elastic/original/3X/d/a/da10682e6334782e5d73b682e717c2ad35b46b7c.png)

Added in this PR: [[Security Solution] Alerts visualization free field selection by kqualters-elastic · Pull Request #120610 · elastic/kibana · GitHub](https://github.com/elastic/kibana/pull/120610)

[https://user-images.githubusercontent.com/56408403/145041383-51adce61-fa24-4c50-b7cc-7f79f608f6df.gif(image larger than 4 MB)](https://user-images.githubusercontent.com/56408403/145041383-51adce61-fa24-4c50-b7cc-7f79f608f6df.gif)

Cheers!  
Garrett

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 10, 2022, 1:13pm UTC](https://discuss.elastic.co/t/how-to-add-client-ip-to-alarm-stack-by/302171/3 "2022-05-10T13:13:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.