# How to check client\_ip ipv4 or ipv6?

**URL:** <https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654>\
**Category:** Logstash\
**Created:** [July 10, 2020, 7:56am UTC](https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654 "2020-07-10T07:56:22Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\
**Post date:** [July 10, 2020, 7:56am UTC](https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654/1 "2020-07-10T07:56:22Z")

</div>

how to use mutate add\_field check client\_ip version v4 or v6?

`if ['client_ip'].length >15 { mutate{ add_field => { "ip_type" => "ipv6" } } } else { mutate{ add_field => { "ip_type" => "ipv4" } } } `

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 10, 2020, 9:04am UTC](https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654/2 "2020-07-10T09:04:16Z")

</div>

> if ['client\_ip'].length \>15

That kind of function does not exist. You'd either use Ruby

```
ruby {
  code => "
    if event.get('client_ip').length > 15 then
      event.set('ip_type', 'ipv6')
    else
      event.set('ip_type', 'ipv4')
    end
  "
} 

```

or a regular expression:

```
if [client_ip] =~ /.{16}/ {
  mutate{ add_field => { "ip_type" => "ipv6" }
} else {
  mutate{ add_field => { "ip_type" => "ipv4" }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 10, 2020, 5:27pm UTC](https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654/3 "2020-07-10T17:27:14Z")

</div>

Not convinced a length check will work. What about :: or ::1, which are valid V6 addresses but short? Perhaps check

```
if [client_ip] =~ /:/

```

V6 addresses are delimited using colon, V4 addresses using a period.

---

<div class="post-metadata">

**Author:** ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\
**Post date:** [July 13, 2020, 9:17am UTC](https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654/4 "2020-07-13T09:17:33Z")

</div>

yeath has sovled  
logstash 【6.2】

if [client\_ip] =~ "._:._" {  
mutate {  
add\_field =\> { "ip\_type" =\> "ipv6" }  
}  
} else {  
mutate {  
add\_field =\> { "ip\_type" =\> "ipv4" }  
}  
}

---

<div class="post-metadata">

**Author:** ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\
**Post date:** [July 13, 2020, 9:23am UTC](https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654/5 "2020-07-13T09:23:18Z")

</div>

If you added an IP\_TYPE field at the current point in time by modifying the logstash configuration file, how would you update this new field for earlier logs?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 13, 2020, 4:24pm UTC](https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654/6 "2020-07-13T16:24:33Z")

</div>

You would need to reindex the data.

---

<div class="post-metadata">

**Author:** ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\
**Post date:** [July 14, 2020, 12:55am UTC](https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654/7 "2020-07-14T00:55:48Z")

</div>

After testing, it seems that Reindex cannot solve the problem of displaying new fields

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 14, 2020, 3:30am UTC](https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654/8 "2020-07-14T03:30:59Z")

</div>

What do you mean by that, you can definitely add fields with a reindex, it depends on what you want to do though.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 11, 2020, 3:31am UTC](https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654/9 "2020-08-11T03:31:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.