# IP address in filebeat

**URL:** <https://discuss.elastic.co/t/ip-address-in-filebeat/134358>\
**Category:** Beats\
**Created:** [June 4, 2018, 6:03am UTC](https://discuss.elastic.co/t/ip-address-in-filebeat/134358 "2018-06-04T06:03:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![gbmzjy](https://avatars.discourse-cdn.com/v4/letter/g/ea666f/32.png) [@gbmzjy](https://discuss.elastic.co/u/gbmzjy)\
**Post date:** [June 4, 2018, 6:03am UTC](https://discuss.elastic.co/t/ip-address-in-filebeat/134358/1 "2018-06-04T06:03:23Z")

</div>

Hi, I am using filebeat in the hosts. The filebeats will forward log files to elastic search server. In order to know where the logs come from the server side, I need filebeat to append IP address to the log before forwarding. Note that we have many hosts and thus want get the host ip address from system. Thanks!

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [June 4, 2018, 8:00am UTC](https://discuss.elastic.co/t/ip-address-in-filebeat/134358/2 "2018-06-04T08:00:55Z")

</div>

Which version of Beats are you using?

Is there any reason you can't use the existing `beat.hostname` field?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [June 4, 2018, 12:04pm UTC](https://discuss.elastic.co/t/ip-address-in-filebeat/134358/3 "2018-06-04T12:04:27Z")

</div>

If you are using Logstash, another option is to use the IP that's in the metadata. See [https://github.com/logstash-plugins/logstash-input-beats/pull/250#issuecomment-315948079](https://github.com/logstash-plugins/logstash-input-beats/pull/250#issuecomment-315948079)

---

<div class="post-metadata">

**Author:** ![gbmzjy](https://avatars.discourse-cdn.com/v4/letter/g/ea666f/32.png) [@gbmzjy](https://discuss.elastic.co/u/gbmzjy)\
**Post date:** [June 5, 2018, 6:21pm UTC](https://discuss.elastic.co/t/ip-address-in-filebeat/134358/4 "2018-06-05T18:21:06Z")

</div>

Thanks a lot for the reply. I am using filebeat-6.2.4-amd64.

My concern is that many of our hosts are using the same hostname, like ubunt 14.04. In this way, I can't distinguish them. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 3, 2018, 8:21pm UTC](https://discuss.elastic.co/t/ip-address-in-filebeat/134358/5 "2018-07-03T20:21:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.