# How to change client\_ip into a custom name in ELK Stack

**URL:** https://discuss.elastic.co/t/how-to-change-client-ip-into-a-custom-name-in-elk-stack/142555
**Category:** Kibana
**Created:** [August 1, 2018, 11:26am UTC](https://discuss.elastic.co/t/how-to-change-client-ip-into-a-custom-name-in-elk-stack/142555 "2018-08-01T11:26:01Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![fernando974](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fernando974/32/33995_2.png) [@fernando974](https://discuss.elastic.co/u/fernando974)
#### Post date: [August 1, 2018, 11:26am UTC](https://discuss.elastic.co/t/how-to-change-client-ip-into-a-custom-name-in-elk-stack/142555/1 "2018-08-01T11:26:01Z")

</div>

Hello,

I am learning to use ELK Stack and i would like to know how to change the value of a fields in kibana.  
I am currently using packetbeat which analyze the traffic on the network in real time with a port mirroring which send the data first to logstash then to elasticsearch and finally to kibana.

I am getting the right client\_ip but i want to change it to get custom name for each client who are connected in kibana visualization

I am using ELK stack in version 6.3  
My network using a proxy btw

Thanks.

Ps: Sorry for my english i'm french ! 🙂

---

<div class="post-metadata">

### Author: ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)
#### Post date: [August 1, 2018, 8:23pm UTC](https://discuss.elastic.co/t/how-to-change-client-ip-into-a-custom-name-in-elk-stack/142555/2 "2018-08-01T20:23:19Z")

</div>

In your data pipeline, since you have Packetbeat sending to Logstash, perhaps you could add the rules for processing the data using filters in the Logstash configuration. That would be the top recommendation: prepare the data as needed before it gets indexed into Elasticsearch, and then you have have it in your index mapping.

See [https://www.elastic.co/guide/en/logstash/current/filter-plugins.html](https://www.elastic.co/guide/en/logstash/current/filter-plugins.html) - there are a ton of filter options and one of them should be suitable for what you need.

---

<div class="post-metadata">

### Author: ![fernando974](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fernando974/32/33995_2.png) [@fernando974](https://discuss.elastic.co/u/fernando974)
#### Post date: [August 2, 2018, 7:10am UTC](https://discuss.elastic.co/t/how-to-change-client-ip-into-a-custom-name-in-elk-stack/142555/3 "2018-08-02T07:10:08Z")

</div>

Yep found it thanks i should have been more careful :

filter {  
if ([client\_ip] == "192.168.1.1") {  
mutate {  
replace =\> {  
"[client\_ip]" =\> "PC1"  
}  
}  
}  
else if ([client\_ip] == "192.168.1.2") {  
mutate {  
replace =\> {  
"[client\_ip]" =\> "PC2"  
}  
}  
}  
else if ([client\_ip] == "192.168.1.3") {  
mutate {  
replace =\> {  
"[client\_ip]" =\> "PC3"  
}  
}  
}

---

<div class="post-metadata">

### Author: ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)
#### Post date: [August 2, 2018, 5:37pm UTC](https://discuss.elastic.co/t/how-to-change-client-ip-into-a-custom-name-in-elk-stack/142555/4 "2018-08-02T17:37:44Z")

</div>

Awesome! Glad it worked.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 30, 2018, 5:51pm UTC](https://discuss.elastic.co/t/how-to-change-client-ip-into-a-custom-name-in-elk-stack/142555/5 "2018-08-30T17:51:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
