### Author:  [@BlackCat](https://discuss.elastic.co/u/BlackCat)
#### Post date: [March 8, 2021, 1:47am UTC](https://discuss.elastic.co/t/i-want-to-output-log-to-elasticsearch-index-from-only-specific-host-ip/266494/1 "2021-03-08T01:47:18Z")
"host.ip" is at "\_source" displayed on Kibana.
Please teach me how to resolve.
logstash config
```auto
input {
beats {
port => 5044
}
}
filter {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:Time} %{HOSTNAME:Hostname} %{GREEDYDATA:Message}" }
}
date {
match => ["Time", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
target => "Time"
}
}
output {
elasticsearch {
hosts => ":9200"
index => "server_log"
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 8, 2021, 1:58am UTC](https://discuss.elastic.co/t/i-want-to-output-log-to-elasticsearch-index-from-only-specific-host-ip/266494/2 "2021-03-08T01:58:29Z")
In the filter section you could use
```
if [host][ip] != "10.197.218.10" { drop {} }
```
If the field actually has a period in the name then that would be
```
if [host.ip] != "10.197.218.10" { drop {} }
```
---
### Author:  [@BlackCat](https://discuss.elastic.co/u/BlackCat)
#### Post date: [March 8, 2021, 6:21am UTC](https://discuss.elastic.co/t/i-want-to-output-log-to-elasticsearch-index-from-only-specific-host-ip/266494/3 "2021-03-08T06:21:00Z")
I tried both.
but, elasticsearch couldn't receive log from host of 10.197.218.10.
Config is below.
```auto
filter {
if [host][ip] != "10.197.218.10" { drop {} }
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:Time} %{HOSTNAME:Hostname} %{GREEDYDATA:Message}" }
}
date {
match => ["Time", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
target => "Time"
}
}
```
```auto
filter {
if [host.ip] != "10.197.218.10" { drop {} }
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:Time} %{HOSTNAME:Hostname} %{GREEDYDATA:Message}" }
}
date {
match => ["Time", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
target => "Time"
}
}
```
"\_source" field is auto generated by system of elastic.
"message" field haven't host.ip.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 8, 2021, 5:20pm UTC](https://discuss.elastic.co/t/i-want-to-output-log-to-elasticsearch-index-from-only-specific-host-ip/266494/4 "2021-03-08T17:20:39Z")
It looks like beats add [host][ip] as an array of IP addresses, so you need an array membership test...
`if "10.197.218.10" not in [host][ip] { drop {} }`
---
### Author:  [@BlackCat](https://discuss.elastic.co/u/BlackCat)
#### Post date: [March 9, 2021, 3:51am UTC](https://discuss.elastic.co/t/i-want-to-output-log-to-elasticsearch-index-from-only-specific-host-ip/266494/5 "2021-03-09T03:51:57Z")
Just resolved.
Thank you.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 6, 2021, 3:52am UTC](https://discuss.elastic.co/t/i-want-to-output-log-to-elasticsearch-index-from-only-specific-host-ip/266494/6 "2021-04-06T03:52:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.