# How to get IP address of collectd client

**URL:** <https://discuss.elastic.co/t/how-to-get-ip-address-of-collectd-client/303674>\
**Category:** Logstash\
**Created:** [May 1, 2022, 3:07pm UTC](https://discuss.elastic.co/t/how-to-get-ip-address-of-collectd-client/303674 "2022-05-01T15:07:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rostam](https://avatars.discourse-cdn.com/v4/letter/r/91b2a8/32.png) [@Rostam](https://discuss.elastic.co/u/Rostam)\
**Post date:** [May 1, 2022, 3:07pm UTC](https://discuss.elastic.co/t/how-to-get-ip-address-of-collectd-client/303674/1 "2022-05-01T15:07:21Z")

</div>

Hello I have configured collectd on all my devices (running Linux).  
The configuration is:  
/etc/collectd.conf

```auto
LoadPlugin cpu
LoadPlugin interface
LoadPlugin df
<Plugin network>
  server "10.2.9.35" "5555"
/Plugin

```

My logstate configuration on the server (10.2.9.35) is  
/etc/logstash/conf.d/collectd.conf:

```auto
input {
  udp {
    port => 3333 # 25826 matches port specified in collectd.conf
    buffer_size => 1452 # 1452 is the default buffer size for Collectd
    codec => collectd { } # specific Collectd codec to invoke
    type => collectd
  }
}
output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}

```

The syslog file on the server gets this type of messages:

```auto
Apr 30 19:04:00 linux-small logstash[11037]: {
Apr 30 19:04:00 linux-small logstash[11037]: "@timestamp" => 2022-05-01T02:04:00.556Z,
Apr 30 19:04:00 linux-small logstash[11037]: "value" => 1612136448.0,
Apr 30 19:04:00 linux-small logstash[11037]: "plugin" => "df",
Apr 30 19:04:00 linux-small logstash[11037]: "collectd_type" => "df_complex",
Apr 30 19:04:00 linux-small logstash[11037]: "@version" => "1",
Apr 30 19:04:00 linux-small logstash[11037]: "type_instance" => "used",
Apr 30 19:04:00 linux-small logstash[11037]: "type" => "collectd",
Apr 30 19:04:00 linux-small logstash[11037]: "host" => "petalinux",
Apr 30 19:04:00 linux-small logstash[11037]: "plugin_instance" => "data",
Apr 30 19:04:00 linux-small logstash[11037]: }

```

My question is how I can extract the source IP address?

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [May 1, 2022, 3:38pm UTC](https://discuss.elastic.co/t/how-to-get-ip-address-of-collectd-client/303674/2 "2022-05-01T15:38:17Z")

</div>

What version of logstash are you using ?  
By default logstash udp input plugin will put the source IP in a host.ip

> **[Udp input plugin | Logstash Reference \[8.1\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-udp.html#plugins-inputs-udp-source_ip_fieldname)**

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 1, 2022, 4:44pm UTC](https://discuss.elastic.co/t/how-to-get-ip-address-of-collectd-client/303674/3 "2022-05-01T16:44:22Z")

</div>

> [@Rostam](#):
>
> ```auto
> "host" => "petalinux",
> 
> ```
> 
> My question is how I can extract the source IP address?

If you are asking how to convert a hostname to an IP address then the answer is to use a [dns](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dns.html) filter (use non-zero cache sizes to improve performance).

---

<div class="post-metadata">

**Author:** ![Rostam](https://avatars.discourse-cdn.com/v4/letter/r/91b2a8/32.png) [@Rostam](https://discuss.elastic.co/u/Rostam)\
**Post date:** [May 1, 2022, 5:22pm UTC](https://discuss.elastic.co/t/how-to-get-ip-address-of-collectd-client/303674/4 "2022-05-01T17:22:17Z")

</div>

Thank you so much that work:

```auto
May 1 10:18:37 inux-small logstash[22505]: "monitoring" => {
May 1 10:18:37 linux-small logstash[22505]: "ip" => "10.1.50.101"
May 1 10:18:37 inux-small logstash[22505]: }

```

---

<div class="post-metadata">

**Author:** ![Rostam](https://avatars.discourse-cdn.com/v4/letter/r/91b2a8/32.png) [@Rostam](https://discuss.elastic.co/u/Rostam)\
**Post date:** [May 1, 2022, 5:25pm UTC](https://discuss.elastic.co/t/how-to-get-ip-address-of-collectd-client/303674/5 "2022-05-01T17:25:36Z")

</div>

Thanks for the answer. We are currently in the lab setup, and we do not have DNS set up yet, once we move to the more production mode, I will use your suggestion.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 29, 2022, 5:25pm UTC](https://discuss.elastic.co/t/how-to-get-ip-address-of-collectd-client/303674/6 "2022-05-29T17:25:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.