# How to get IP through metricbeat from Windows systems?

**URL:** <https://discuss.elastic.co/t/how-to-get-ip-through-metricbeat-from-windows-systems/147235>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [September 4, 2018, 2:59pm UTC](https://discuss.elastic.co/t/how-to-get-ip-through-metricbeat-from-windows-systems/147235 "2018-09-04T14:59:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![shahid3507](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@shahid3507](https://discuss.elastic.co/u/shahid3507)\
**Post date:** [September 4, 2018, 2:59pm UTC](https://discuss.elastic.co/t/how-to-get-ip-through-metricbeat-from-windows-systems/147235/1 "2018-09-04T14:59:02Z")

</div>

I am using elk stack and metricbeat for getting metrices from windows machines but as socket metricset is not supported for windows, Is there any way to get IP from windows systems through metricbeat.

---

<div class="post-metadata">

**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\
**Post date:** [September 5, 2018, 11:56am UTC](https://discuss.elastic.co/t/how-to-get-ip-through-metricbeat-from-windows-systems/147235/2 "2018-09-05T11:56:28Z")

</div>

Hi @shahid3507 🙂

I'm not fully sure about what you're looking for. Do you need a tag including the IP of each metric to split your graphs by node? In such case, you can enhance exported data by using `add_host_metadata` processor: [https://www.elastic.co/guide/en/beats/filebeat/6.4/add-host-metadata.html](https://www.elastic.co/guide/en/beats/filebeat/6.4/add-host-metadata.html)

---

<div class="post-metadata">

**Author:** ![shahid3507](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@shahid3507](https://discuss.elastic.co/u/shahid3507)\
**Post date:** [September 5, 2018, 1:21pm UTC](https://discuss.elastic.co/t/how-to-get-ip-through-metricbeat-from-windows-systems/147235/3 "2018-09-05T13:21:07Z")

</div>

Yes @Mario_Castro , that is what I exactly want.  
But can IP be sent with each and every metricset just like hostname is sent.

---

<div class="post-metadata">

**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\
**Post date:** [September 6, 2018, 8:19am UTC](https://discuss.elastic.co/t/how-to-get-ip-through-metricbeat-from-windows-systems/147235/4 "2018-09-06T08:19:40Z")

</div>

Once you add `add_host_metadata`, IP should be attached to each metric sent.

Do you have an example of metrics where IP is and isn't attached?

---

<div class="post-metadata">

**Author:** ![shahid3507](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@shahid3507](https://discuss.elastic.co/u/shahid3507)\
**Post date:** [September 6, 2018, 8:48am UTC](https://discuss.elastic.co/t/how-to-get-ip-through-metricbeat-from-windows-systems/147235/5 "2018-09-06T08:48:22Z")

</div>

Yes @Mario_Castro , the following is the one with ip

```
    {
  "_index": "metricbeat-6.4.0-2018.09.06",
  "_type": "logs",
  "_id": "AWWuDZhYkfhBp1BqVA9c",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2018-09-06T08:44:10.230Z",
    "system": {
      "network": {
        "name": "Teredo Tunneling Pseudo-Interface",
        "in": {
          "dropped": 0,
          "errors": 0,
          "bytes": 392904,
          "packets": 4091
        },
        "out": {
          "dropped": 0,
          "bytes": 400140,
          "errors": 0,
          "packets": 3464
        }
      }
    },
    "host": {
      "os": {
        "family": "windows",
        "version": "10.0",
        "build": "14393.2273",
        "platform": "windows"
      },
      "ip": [
        "10.45.0.5",
        "fe80::5efe:a2d:5",
        "2001:0:9d38:78cf:842:c889:a17d:ee8a",
        "fe80::842:c889:a17d:ee8a"
      ],
      "name": "host6-1029384756",
      "id": "4f14c21c-c6c5-493e-bf6e-5018145d95e8",
      "mac": [
        "x:x:x:x:x",
        "00:00:00:00:00:00:00:e0",
        "00:00:00:00:00:00:00:e0"
      ],
      "architecture": "x86_64"
    },
    "beat": {
      "name": "host6-1029384756",
      "hostname": "host6-1029384756",
      "version": "6.4.0"
    },
    "@version": "1",
    "metricset": {
      "name": "network",
      "module": "system"
    },
    "tags": [
      "beats_input_raw_event"
    ]
  },
  "fields": {
    "@timestamp": [
      1536223450230
    ]
  },
  "sort": [
    1536223450230
  ]
}

```

and the next one is without ip

```
    {
  "_index": "metricbeat-6.4.0-2018.09.06",
  "_type": "logs",
  "_id": "AWWuDZhYkfhBp1BqVA9e",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2018-09-06T08:44:10.647Z",
    "system": {
      "network": {
        "name": "Ethernet0",
        "in": {
          "dropped": 0,
          "bytes": 42149727,
          "packets": 187986,
          "errors": 0
        },
        "out": {
          "dropped": 0,
          "errors": 0,
          "packets": 207730,
          "bytes": 182044691
        }
      }
    },
    "beat": {
      "name": "host6-1029384756",
      "hostname": "host6-1029384756",
      "version": "6.4.0"
    },
    "host": {
      "name": "host6-1029384756"
    },
    "@version": "1",
    "metricset": {
      "name": "network",
      "module": "system"
    },
    "tags": [
      "beats_input_raw_event"
    ]
  },
  "fields": {
    "@timestamp": [
      1536223450647
    ]
  },
  "sort": [
    1536223450647
  ]
}
```

---

<div class="post-metadata">

**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\
**Post date:** [September 10, 2018, 1:03pm UTC](https://discuss.elastic.co/t/how-to-get-ip-through-metricbeat-from-windows-systems/147235/6 "2018-09-10T13:03:53Z")

</div>

For me, it seems that the second machine isn't connected to any network and that's why it's not showing up anything. You mentioned that you were shipping data using a socket, right?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 8, 2018, 1:03pm UTC](https://discuss.elastic.co/t/how-to-get-ip-through-metricbeat-from-windows-systems/147235/7 "2018-10-08T13:03:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
