How to get internal ip address from filebeat?

Elastic Stack Beats
21

Hi Varun,

I believe you are using Logstash to ingest and parse the data that you receive from FileBeat.

Could you please answer a few questions?

  1. Are you using the GeoIP filter in Logstash?
  2. Have you defined any specific mappings in Elasticsearch as defined in this blog post for GeoIP?
    GeoIP in the Elastic Stack - Elasticsearch, Logstash, Ingest API | Elastic Blog
  3. What is the field structure for the IP address field?
    I ask you this because you mentioned this:

I believe the fields are populated by the GeoIP filter (Logstash, Beats or any other ETL on the planet), and if so, it does not work if the IP address is a private IP.

22

  1. i think filebeat iis using geoip filter

  2. i didn't do anything. all default to iis filebeat

  3. ip address field will be like 10.0.0.1

23

what is the solution for that ?

24

Hi Varun,

As mentioned earlier. GeoIP cannot work on a private IP. You will have to do the enrichment yourself.

25

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.