How to get IP address of collectd client

Elastic Stack Logstash
#1

Hello I have configured collectd on all my devices (running Linux).
The configuration is:
/etc/collectd.conf

LoadPlugin cpu
LoadPlugin interface
LoadPlugin df
<Plugin network>
  server "10.2.9.35" "5555"
/Plugin

My logstate configuration on the server (10.2.9.35) is
/etc/logstash/conf.d/collectd.conf:

input {
  udp {
    port => 3333         # 25826 matches port specified in collectd.conf
    buffer_size => 1452   # 1452 is the default buffer size for Collectd
    codec => collectd { } # specific Collectd codec to invoke
    type => collectd
  }
}
output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}

The syslog file on the server gets this type of messages:

Apr 30 19:04:00 linux-small logstash[11037]: {
Apr 30 19:04:00 linux-small logstash[11037]:          "@timestamp" => 2022-05-01T02:04:00.556Z,
Apr 30 19:04:00 linux-small logstash[11037]:               "value" => 1612136448.0,
Apr 30 19:04:00 linux-small logstash[11037]:              "plugin" => "df",
Apr 30 19:04:00 linux-small logstash[11037]:       "collectd_type" => "df_complex",
Apr 30 19:04:00 linux-small logstash[11037]:            "@version" => "1",
Apr 30 19:04:00 linux-small logstash[11037]:       "type_instance" => "used",
Apr 30 19:04:00 linux-small logstash[11037]:                "type" => "collectd",
Apr 30 19:04:00 linux-small logstash[11037]:                "host" => "petalinux",
Apr 30 19:04:00 linux-small logstash[11037]:     "plugin_instance" => "data",
Apr 30 19:04:00 linux-small logstash[11037]: }

My question is how I can extract the source IP address?

#2

What version of logstash are you using ?
By default logstash udp input plugin will put the source IP in a host.ip

#3

If you are asking how to convert a hostname to an IP address then the answer is to use a dns filter (use non-zero cache sizes to improve performance).

#4

Thank you so much that work:

May  1 10:18:37 inux-small logstash[22505]:         "monitoring" => {
May  1 10:18:37 linux-small logstash[22505]:             "ip" => "10.1.50.101"
May  1 10:18:37 inux-small logstash[22505]:         }
#5

Thanks for the answer. We are currently in the lab setup, and we do not have DNS set up yet, once we move to the more production mode, I will use your suggestion.

#6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.