# How to convert src\_ip to ip

**URL:** <https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557>\
**Category:** Logstash\
**Created:** [December 29, 2017, 9:27am UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557 "2017-12-29T09:27:48Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mario\_van\_Gemert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_van_gemert/32/13832_2.png) [@Mario\_van\_Gemert](https://discuss.elastic.co/u/Mario_van_Gemert)\
**Post date:** [December 29, 2017, 9:27am UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557/1 "2017-12-29T09:27:48Z")

</div>

Just succesfull read my Cisco ASA logs, but I am now looking for a way to convert my src\_ip (string) in a way that I am able to use it as a geo\_point on the Coordinate Map. Can anyone tell me how my filter section should look like? I already installed the ingest-geoip within Elasticsearch. Using version 6.1.0.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 29, 2017, 9:30am UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557/2 "2017-12-29T09:30:29Z")

</div>

If you are using Logstash then just use [https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html) 🙂

---

<div class="post-metadata">

**Author:** ![Mario\_van\_Gemert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_van_gemert/32/13832_2.png) [@Mario\_van\_Gemert](https://discuss.elastic.co/u/Mario_van_Gemert)\
**Post date:** [December 29, 2017, 9:52am UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557/3 "2017-12-29T09:52:59Z")

</div>

I added following to my filter:

geoip {  
source =\> "src\_ip"  
target =\> "geoip"  
}  
mutate {  
convert =\> ["geoip", "float"]  
}

But this results in a:  
"geoip": {  
"type": "object"

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 29, 2017, 9:54am UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557/4 "2017-12-29T09:54:10Z")

</div>

> [@Mario\_van\_Gemert](#):
>
> mutate {
> 
> convert =\> ["geoip", "float"]
> 
> }

You do not need this bit, so try it without.

---

<div class="post-metadata">

**Author:** ![Mario\_van\_Gemert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_van_gemert/32/13832_2.png) [@Mario\_van\_Gemert](https://discuss.elastic.co/u/Mario_van_Gemert)\
**Post date:** [December 29, 2017, 9:58am UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557/5 "2017-12-29T09:58:13Z")

</div>

But I now only see the src\_ip as a string within my map. So, no geoip.

"src\_ip": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 29, 2017, 9:59am UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557/6 "2017-12-29T09:59:31Z")

</div>

Please show your entire config.

Please also make sure you format it with the code button - `</>`.

---

<div class="post-metadata">

**Author:** ![Mario\_van\_Gemert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_van_gemert/32/13832_2.png) [@Mario\_van\_Gemert](https://discuss.elastic.co/u/Mario_van_Gemert)\
**Post date:** [December 29, 2017, 10:04am UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557/7 "2017-12-29T10:04:12Z")

</div>

```
input {
    udp {
            port => 9996
            type => "cisco-fw"
    }

```

}

filter {

```
    # Extract fields from the each of the detailed message types
    # The patterns provided below are included in core of LogStash 1.4.2.
    grok {
            match => [
                    "message", "%{CISCOFW106001}",
                    "message", "%{CISCOFW106006_106007_106010}",
                    "message", "%{CISCOFW106014}",
                    "message", "%{CISCOFW106015}",
                    "message", "%{CISCOFW106021}",
                    "message", "%{CISCOFW106023}",
                    "message", "%{CISCOFW106100}",
                    "message", "%{CISCOFW110002}",
                    "message", "%{CISCOFW302010}",
                    "message", "%{CISCOFW302013_302014_302015_302016}",
                    "message", "%{CISCOFW302020_302021}",
                    "message", "%{CISCOFW305011}",
                    "message", "%{CISCOFW313001_313004_313008}",
                    "message", "%{CISCOFW313005}",
                    "message", "%{CISCOFW402117}",
                    "message", "%{CISCOFW402119}",
                    "message", "%{CISCOFW419001}",
                    "message", "%{CISCOFW419002}",
                    "message", "%{CISCOFW500004}",
                    "message", "%{CISCOFW602303_602304}",
                    "message", "%{CISCOFW710001_710002_710003_710005_710006}",
                    "message", "%{CISCOFW713172}",
                    "message", "%{CISCOFW733100}"
            ]
    }

    # Parse the syslog severity and facility
    syslog_pri { }

```

# Do a DNS lookup for the sending host

# Otherwise host field will contain an

# IP address instead of a hostname

dns {  
reverse =\> ["host"]  
action =\> "replace"  
}  
}

output {

# if [type] == "netflow" {

```
stdout { codec => dots }
 elasticsearch
    {
     hosts => ["localhost:9200"]
     index => "netflow-%{+YYYY.MM.dd}"
    }

```

# }

}

---

<div class="post-metadata">

**Author:** ![Mario\_van\_Gemert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_van_gemert/32/13832_2.png) [@Mario\_van\_Gemert](https://discuss.elastic.co/u/Mario_van_Gemert)\
**Post date:** [December 29, 2017, 10:05am UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557/8 "2017-12-29T10:05:08Z")

</div>

I am not familiar with a code button, sorry ☹.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 29, 2017, 10:05am UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557/9 "2017-12-29T10:05:10Z")

</div>

It's probably because you don't have a template that matches that field so it isn't being mapped. Have a read through [https://www.elastic.co/blog/geoip-in-the-elastic-stack](https://www.elastic.co/blog/geoip-in-the-elastic-stack), it'll help.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 29, 2017, 10:05am UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557/10 "2017-12-29T10:05:32Z")

</div>

It's literally in the formatting bar above where you type.

---

<div class="post-metadata">

**Author:** ![Mario\_van\_Gemert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_van_gemert/32/13832_2.png) [@Mario\_van\_Gemert](https://discuss.elastic.co/u/Mario_van_Gemert)\
**Post date:** [December 29, 2017, 10:07am UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557/11 "2017-12-29T10:07:13Z")

</div>

I will read the blog, thnx! Indeed I do not have a template.

---

<div class="post-metadata">

**Author:** ![Mario\_van\_Gemert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_van_gemert/32/13832_2.png) [@Mario\_van\_Gemert](https://discuss.elastic.co/u/Mario_van_Gemert)\
**Post date:** [December 29, 2017, 12:21pm UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557/12 "2017-12-29T12:21:55Z")

</div>

Problem solved. Thnx!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 26, 2018, 12:21pm UTC](https://discuss.elastic.co/t/how-to-convert-src-ip-to-ip/113557/13 "2018-01-26T12:21:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.