# Is it possible to get individual IP address count from different sources to my server(packetbeat installed)

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-get-individual-ip-address-count-from-different-sources-to-my-server-packetbeat-installed/82316>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [April 13, 2017, 2:56pm UTC](https://discuss.elastic.co/t/is-it-possible-to-get-individual-ip-address-count-from-different-sources-to-my-server-packetbeat-installed/82316 "2017-04-13T14:56:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gurram\_Vinay](https://avatars.discourse-cdn.com/v4/letter/g/85e7bf/32.png) [@Gurram\_Vinay](https://discuss.elastic.co/u/Gurram_Vinay)\
**Post date:** [April 13, 2017, 2:56pm UTC](https://discuss.elastic.co/t/is-it-possible-to-get-individual-ip-address-count-from-different-sources-to-my-server-packetbeat-installed/82316/1 "2017-04-13T14:56:30Z")

</div>

I am using "packet beats" for my project which is related to DoS(Denial of service) attacks. Is it possible to make "packetbeat" to store unique ip addresses(from different sources) along with some parameters --\> count on real time.Based on that detecting and alerting stuff.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 13, 2017, 3:10pm UTC](https://discuss.elastic.co/t/is-it-possible-to-get-individual-ip-address-count-from-different-sources-to-my-server-packetbeat-installed/82316/2 "2017-04-13T15:10:26Z")

</div>

You an use a [cardinality aggregation](https://www.elastic.co/guide/en/elasticsearch/guide/current/cardinality.html) in Elasticsearch to count the number of unique IP addresses.

---

<div class="post-metadata">

**Author:** ![Gurram\_Vinay](https://avatars.discourse-cdn.com/v4/letter/g/85e7bf/32.png) [@Gurram\_Vinay](https://discuss.elastic.co/u/Gurram_Vinay)\
**Post date:** [April 13, 2017, 3:22pm UTC](https://discuss.elastic.co/t/is-it-possible-to-get-individual-ip-address-count-from-different-sources-to-my-server-packetbeat-installed/82316/3 "2017-04-13T15:22:18Z")

</div>

thanks for quick reply Mr.Andrewkroh, I will go through 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2017, 3:34pm UTC](https://discuss.elastic.co/t/is-it-possible-to-get-individual-ip-address-count-from-different-sources-to-my-server-packetbeat-installed/82316/4 "2017-05-11T15:34:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.