How to create a visualization based on a unique count of an IP field but excluding port number?

[Silvy20]

Hello,

I need to create a visualization based on unique count of IPs, however the field available in kibana is in the following format:

xx.xx.xx.xx:xxxx

I would like to know if through formulas (fe) I have a way to calculate the unique count fo the IPs but excluding the last part ":xxxx".

Thanks in advance.

[GinkoLucas]

Hi, I don't know if there's a perfect solution, but you could create a new field containing the ip in the format you want.
I have two solutions in mind:

• Use a Runtime Field (Runtime fields | Elasticsearch Guide [8.16] | Elastic)
• Extract the part you're interested in using a Grok processor in an ingest Pipeline (Grok processor | Elasticsearch Guide [8.16] | Elastic)