# IPV6 messes up the logstash

**URL:** <https://discuss.elastic.co/t/ipv6-messes-up-the-logstash/148898>\
**Category:** Logstash\
**Created:** [September 17, 2018, 11:39pm UTC](https://discuss.elastic.co/t/ipv6-messes-up-the-logstash/148898 "2018-09-17T23:39:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Samvid\_Kulkarni](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Samvid\_Kulkarni](https://discuss.elastic.co/u/Samvid_Kulkarni)\
**Post date:** [September 17, 2018, 11:39pm UTC](https://discuss.elastic.co/t/ipv6-messes-up-the-logstash/148898/1 "2018-09-17T23:39:53Z")

</div>

I am parsing Microsoft IIS filter logs and some of the logs have IPV4 and some have IPV6. All those logs have `IPV6 with scope id` are getting output with which is complete messed up. I have tested this in Grok Debugger (inside Kibana) and on [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/).

Here is the log output:

> 2018-09-17 23:09:50 fe80::506d:e3e3:d813:5380%13 POST /mapi/emsmdb/ [MailboxId=8df67065-38b2-4548-a250-cb9f8e04e25e@dadco.com](mailto:MailboxId=8df67065-38b2-4548-a250-cb9f8e04e25e@dadco.com) 444 Anonymous fe80::506d:e3e3:d813:5380%13 Microsoft+Office/16.0+(Windows+NT+6.1;+Microsoft+Outlook+16.0.4639;+Pro) - 200 0 0 3

And here is my Grok Pattern:

> ^%{TIMESTAMP\_ISO8601:timestamp} %{IP:destination\_ip}%{SPACE}%{USERNAME:type} %{NOTSPACE:site}%{SPACE}MailboxId=%{NOTSPACE:request\_id} %{NUMBER:port} %{NOTSPACE:host} %{IP:source\_ip}%{SPACE}%{NOTSPACE:software} (-)? %{NUMBER:port2} %{NUMBER:num} %{NUMBER:num2} (%{NUMBER:num3})?

This only happens when the `IPV6` has `scope ID` at the end which is '%" sign and some number. More details about scope id can be found [here](https://superuser.com/questions/99746/why-is-there-a-percent-sign-in-the-ipv6-address) and [here](https://msdn.microsoft.com/en-us/library/aa917150.aspx).

This is the output in Grok Debugger (inside Kibana)

> {  
> "software": ")",  
> "num": "0",  
> "type": "T",  
> "source\_ip": "fe80::506d:e3e3:d813:5380%13 Microsoft+Office/16.0+(Windows+NT+6.1;+Microsoft+Outlook+16.0.4639;+Pro",  
> "port2": "200",  
> "site": "/mapi/emsmdb/",  
> "destination\_ip": "fe80::506d:e3e3:d813:5380%13 POS",  
> "port": "444",  
> "host": "Anonymous",  
> "request\_id": "[8df67065-38b2-4548-a250-cb9f8e04e25e@dadco.com](mailto:8df67065-38b2-4548-a250-cb9f8e04e25e@dadco.com)",  
> "num3": "3",  
> "timestamp": "2018-09-17 23:09:50",  
> "num2": "0"  
> }

As you can see both `source_ip` and `destination_ip` has some text which shouldn't be there to begin with. I cannot use just `IPV6` filter as some of the logs have `IPV4` in them so instead of writing with two different grok patterns I am using IP to match both.

Is this some kind of bug or am I doing something wrong?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 18, 2018, 7:22am UTC](https://discuss.elastic.co/t/ipv6-messes-up-the-logstash/148898/2 "2018-09-18T07:22:08Z")

</div>

I suggest you use the NOTSPACE pattern to match the IP address. The IPV6 pattern is extremely long and probably expensive to match against, plus it ends with `(%.+)?` which is probably not a great idea (and it's also the reason why you're having a bad time).

---

<div class="post-metadata">

**Author:** ![Samvid\_Kulkarni](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Samvid\_Kulkarni](https://discuss.elastic.co/u/Samvid_Kulkarni)\
**Post date:** [September 18, 2018, 5:54pm UTC](https://discuss.elastic.co/t/ipv6-messes-up-the-logstash/148898/3 "2018-09-18T17:54:06Z")

</div>

> [@Samvid\_Kulkarni](#):
>
> fe80::506d:e3e3:d813:5380%13

Thank you very much for helping me. I did change my filter to `NOTSPACE` and it is working great.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2018, 6:07pm UTC](https://discuss.elastic.co/t/ipv6-messes-up-the-logstash/148898/4 "2018-10-16T18:07:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.