# How to add ip (any specific parameters) to filter in logstash?
**URL:** https://discuss.elastic.co/t/how-to-add-ip-any-specific-parameters-to-filter-in-logstash/39398
**Category:** Logstash
**Created:** [January 17, 2016, 10:17am UTC](https://discuss.elastic.co/t/how-to-add-ip-any-specific-parameters-to-filter-in-logstash/39398 "2016-01-17T10:17:14Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Mohamed\_Ibrahim](https://discuss.elastic.co/u/Mohamed_Ibrahim)
#### Post date: [January 17, 2016, 10:17am UTC](https://discuss.elastic.co/t/how-to-add-ip-any-specific-parameters-to-filter-in-logstash/39398/1 "2016-01-17T10:17:14Z")
i successfully revived the below masses on my web server
10.29.10.204 - - [17/Jan/2016:00:12:16 +0300] "GET /POS-WS-Client/mTopup?uid= **&password=** &amount=20&msisdn=012&tid=0 HTTP/1.1" 200 21
actually i need to know to cut on this message on any spasfic filed
for example IP address i need to know top 10 ip ? or top 10 UID ?
---
### Author:  [@Mohamed\_Ibrahim](https://discuss.elastic.co/u/Mohamed_Ibrahim)
#### Post date: [January 17, 2016, 10:36am UTC](https://discuss.elastic.co/t/how-to-add-ip-any-specific-parameters-to-filter-in-logstash/39398/2 "2016-01-17T10:36:50Z")
my configurations file **/etc/logstash/conf.d/10-syslog.conf** as below;
filter {
if [type] == "syslog" {
grok {
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{host}"]
}
syslog\_pri { }
date {
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 17, 2016, 4:31pm UTC](https://discuss.elastic.co/t/how-to-add-ip-any-specific-parameters-to-filter-in-logstash/39398/3 "2016-01-17T16:31:49Z")
You should indeed use a grok filter to parse fields out of a string, but your logfile is a standard HTTP logfile and a syslog grok expression won't be able to parse it. I expect you'll have better luck with the COMMONAPACHELOG pattern.
---
### Author:  [@Mohamed\_Ibrahim](https://discuss.elastic.co/u/Mohamed_Ibrahim)
#### Post date: [January 18, 2016, 2:36pm UTC](https://discuss.elastic.co/t/how-to-add-ip-any-specific-parameters-to-filter-in-logstash/39398/4 "2016-01-18T14:36:21Z")
> [@magnusbaeck](#):
>
> standard HTTP
what is the different between standard HTTP logfile and the other standers
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 18, 2016, 6:21pm UTC](https://discuss.elastic.co/t/how-to-add-ip-any-specific-parameters-to-filter-in-logstash/39398/5 "2016-01-18T18:21:03Z")
Not sure what you mean but... many HTTP log files have the same format as your file (a format often called "common") but the "combined" format is also common (see the COMBINEDAPACHELOG pattern). Those are the two reasonably standardized formats, at least on Unix-based systems.
---
### Author:  [@elvarb](https://discuss.elastic.co/u/elvarb)
#### Post date: [January 18, 2016, 9:39pm UTC](https://discuss.elastic.co/t/how-to-add-ip-any-specific-parameters-to-filter-in-logstash/39398/6 "2016-01-18T21:39:14Z")
Use this [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/)
Love it and cherish it, the most useful aid there is for parsing.
Also, you should seriously consider not using GET that includes a password value, big security risk
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:15am UTC](https://discuss.elastic.co/t/how-to-add-ip-any-specific-parameters-to-filter-in-logstash/39398/7 "2017-07-06T05:15:17Z")