# How to remove ipv6 from host.ip

**URL:** <https://discuss.elastic.co/t/how-to-remove-ipv6-from-host-ip/284341>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [September 16, 2021, 2:35am UTC](https://discuss.elastic.co/t/how-to-remove-ipv6-from-host-ip/284341 "2021-09-16T02:35:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![xizhimen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xizhimen/32/94639_2.png) [@xizhimen](https://discuss.elastic.co/u/xizhimen)\
**Post date:** [September 16, 2021, 2:35am UTC](https://discuss.elastic.co/t/how-to-remove-ipv6-from-host-ip/284341/1 "2021-09-16T02:35:50Z")

</div>

**background:**  
winlogbeat7.3.2  
windows2016  
winlogbeat.yml:

```auto
processors:

  - add_host_metadata:
      netinfo.enabled: true

```

**requirement:**  
in kibana:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/2/d2979c7344b8b7baf4cca54c62ba824e3f38f9bb.png)

I want to remove this ipv6 info ,How? THANKS!

I try to remove ipv6 info with script 🙂

```auto
  - script:
      lang: javascript
      id: my_filter
      source: >
        function process(event) {
            var message = event.Get("host.ip")
            event.Put("len",message.length)
            for (var i=0; i<message.length; i++)
            {
                if (message[i].indexOf("192.") > -1)
                {
                    event.Put("host.ip",message[i])
                    break;
                }
            }
        }

```

but recevie:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c576748f024e687d575cfa101aa67e88b878c610.png)

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [September 16, 2021, 2:30pm UTC](https://discuss.elastic.co/t/how-to-remove-ipv6-from-host-ip/284341/2 "2021-09-16T14:30:21Z")

</div>

I could not reproduce the panic on the latest version. Please try a newer release.

---

<div class="post-metadata">

**Author:** ![xizhimen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xizhimen/32/94639_2.png) [@xizhimen](https://discuss.elastic.co/u/xizhimen)\
**Post date:** [September 17, 2021, 1:56am UTC](https://discuss.elastic.co/t/how-to-remove-ipv6-from-host-ip/284341/3 "2021-09-17T01:56:05Z")

</div>

```auto
function process(event) {
            var message = event.Get("host.ip")
            event.Put("len",message.length)
            for (var i=0; i<message.length; i++)
            {
                if (message[i].indexOf("192.") > -1)
                {
                    event.Put("host.ip",message[i])
                    break;
                }
            }
        }

```

Is there any problem with the code?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [September 17, 2021, 2:14am UTC](https://discuss.elastic.co/t/how-to-remove-ipv6-from-host-ip/284341/4 "2021-09-17T02:14:53Z")

</div>

That code works. Of course there are other ways to implement this, but it puts the first 192 address into host.ip and returns.

---

<div class="post-metadata">

**Author:** ![xizhimen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xizhimen/32/94639_2.png) [@xizhimen](https://discuss.elastic.co/u/xizhimen)\
**Post date:** [October 9, 2021, 6:40am UTC](https://discuss.elastic.co/t/how-to-remove-ipv6-from-host-ip/284341/5 "2021-10-09T06:40:59Z")

</div>

what is other ways?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2021, 8:41am UTC](https://discuss.elastic.co/t/how-to-remove-ipv6-from-host-ip/284341/6 "2021-11-06T08:41:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.