# How to get the IP address of the HTTP request sender using logstash?
**URL:** https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender-using-logstash/78891
**Category:** Logstash
**Created:** [March 16, 2017, 3:21pm UTC](https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender-using-logstash/78891 "2017-03-16T15:21:46Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@gourab.jtv](https://discuss.elastic.co/u/gourab.jtv)
#### Post date: [March 16, 2017, 3:21pm UTC](https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender-using-logstash/78891/1 "2017-03-16T15:21:46Z")
I am trying to find the IP address of the HTTP request sender (using Logstash HTTP input plugin) in logstash.
```
curl -XPUT 'http://127.0.0.1:8080/twitter/tweet/1' -d 'hello'
```
My config file for logstash is:
```
input {
http {
host => "127.0.0.1"
port => "8080"
}
}
filter {
geoip {
source => #I want the IP of the sender here
target => "geoip"
database => "/home/gourab/logstash-5.2.2/GeoIP2-City.mmdb"
add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => ["[geoip][coordinates]", "float"]
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["192.168.1.193:9200"]
action => "index"
index => "temp_load_index"
}
}
```
---
### Author:  [@whyapenny](https://discuss.elastic.co/u/whyapenny)
#### Post date: [March 16, 2017, 3:55pm UTC](https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender-using-logstash/78891/2 "2017-03-16T15:55:36Z")
is the ip coming from an apache log? can you provide the logs that have the ipaddress and your grok parse statement?
sorry, i see what you are saying. You want the ipaddress of someone hitting logstash directly? Im not sure how that could be done as i have never seen that use case. is there a reason you are using logstash as a web server?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 17, 2017, 6:29am UTC](https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender-using-logstash/78891/3 "2017-03-17T06:29:00Z")
Isn't this information stored in the `host` field?
---
### Author:  [@gourab.jtv](https://discuss.elastic.co/u/gourab.jtv)
#### Post date: [March 17, 2017, 7:01am UTC](https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender-using-logstash/78891/4 "2017-03-17T07:01:15Z")
No, it's not stored anywhere. I just want to know IP of the system that is sending the HTTP request to logstash.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 17, 2017, 7:05am UTC](https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender-using-logstash/78891/5 "2017-03-17T07:05:51Z")
It's certainly stored in `host` for me:
```nohighlight
$ cat test.config
input {
http {
host => "127.0.0.1"
port => "8080"
}
}
output { stdout { codec => rubydebug } }
$ /opt/logstash/bin/logstash -f test.config
Settings: Default pipeline workers: 8
Pipeline main started
{
"message" => "hello",
"@version" => "1",
"@timestamp" => "2017-03-17T07:04:06.866Z",
"host" => "127.0.0.1",
"headers" => {
"request_method" => "PUT",
"request_path" => "/twitter/tweet/1",
"request_uri" => "/twitter/tweet/1",
"http_version" => "HTTP/1.1",
"http_user_agent" => "curl/7.26.0",
"http_host" => "127.0.0.1:8080",
"http_accept" => "*/*",
"content_length" => "5",
"content_type" => "application/x-www-form-urlencoded"
}
}
```
(Using the exact same curl command that you posted.)
---
### Author:  [@gourab.jtv](https://discuss.elastic.co/u/gourab.jtv)
#### Post date: [March 17, 2017, 7:10am UTC](https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender-using-logstash/78891/6 "2017-03-17T07:10:10Z")
If I am not wrong we can read the header of the HTTP request sender.
```
"headers" : {
"http_accept" : "*/*",
"content_type" : "application/x-www-form-urlencoded",
"request_path" : "/twitter/tweet/1",
"http_version" : "HTTP/1.1",
"request_method" : "PUT",
"http_host" : "127.0.0.1:8080",
"request_uri" : "/twitter/tweet/1",
"content_length" : "5",
"http_user_agent" : "curl/7.47.0"
},
```
I just wished to know if the IP of the sender.
---
### Author:  [@gourab.jtv](https://discuss.elastic.co/u/gourab.jtv)
#### Post date: [March 17, 2017, 7:11am UTC](https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender-using-logstash/78891/7 "2017-03-17T07:11:40Z")
I think host is the IP of the system that is running the Logstash. I want the IP of the sent message "hello" to my logstash.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 17, 2017, 7:16am UTC](https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender-using-logstash/78891/8 "2017-03-17T07:16:20Z")
> I think host is the IP of the system that is running the Logstash.
The source code indicates otherwise.
>
This is very easy for you to verify. If you have evidence that it really is the IP address of the local host then please present them.
---
### Author:  [@gourab.jtv](https://discuss.elastic.co/u/gourab.jtv)
#### Post date: [March 17, 2017, 9:11am UTC](https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender-using-logstash/78891/9 "2017-03-17T09:11:37Z")
Thanks. `host` is what I was looking for. (The problem was I was running it on local systems that's why 127.0.0.1)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 14, 2017, 9:11am UTC](https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender-using-logstash/78891/10 "2017-04-14T09:11:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.