# Jdbc logstash module pulling IP in decimal format

**URL:** https://discuss.elastic.co/t/jdbc-logstash-module-pulling-ip-in-decimal-format/273948
**Category:** Logstash
**Created:** [May 25, 2021, 1:46pm UTC](https://discuss.elastic.co/t/jdbc-logstash-module-pulling-ip-in-decimal-format/273948 "2021-05-25T13:46:38Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![tushar.bansal](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)
#### Post date: [May 25, 2021, 1:46pm UTC](https://discuss.elastic.co/t/jdbc-logstash-module-pulling-ip-in-decimal-format/273948/1 "2021-05-25T13:46:39Z")

</div>

Hi,

I am pulling events from sqlserver using jdbc module in logstash.

I get all events I queried for, but IP is coming in different format. I think it is decimal format. I want them in regular IP notation a.b.c.d format.

examples:  
1411339896  
-1979711478   
8485306  
999744501

Any suggestions?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 25, 2021, 2:53pm UTC](https://discuss.elastic.co/t/jdbc-logstash-module-pulling-ip-in-decimal-format/273948/2 "2021-05-25T14:53:44Z")

</div>

You would use a ruby filter

```
input { generator { count => 1 lines => ['1411339896', '-1979711478', '8485306', '999744501'] } }
filter {
    ruby {
        code => '
            n = event.get("message").to_i
            event.set("ip", [n].pack("N").unpack("CCCC").join("."))
        '
    }
}
output { stdout { codec => rubydebug { metadata => false } } }

```

produces events like

```
        "ip" => "138.0.0.10",
   "message" => "-1979711478"

        "ip" => "0.129.121.186",
   "message" => "8485306"

```

I am somewhat skeptical of the second one .

---

<div class="post-metadata">

### Author: ![tushar.bansal](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)
#### Post date: [May 25, 2021, 5:22pm UTC](https://discuss.elastic.co/t/jdbc-logstash-module-pulling-ip-in-decimal-format/273948/4 "2021-05-25T17:22:59Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/6/9/69b81eb6f44ac3b904ed47eb65ae627099d1c483.png)

I applied that, but I get 0.0.0.0 for all values.

Filter:

```
filter {
  ruby {
    code => '
        n = event.get("IPv4").to_i
        event.set("IP", [n].pack("N").unpack("CCCC").join("."))
    '
  }
}
```

---

<div class="post-metadata">

### Author: ![tushar.bansal](https://avatars.discourse-cdn.com/v4/letter/t/e495f1/32.png) [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)
#### Post date: [May 25, 2021, 6:22pm UTC](https://discuss.elastic.co/t/jdbc-logstash-module-pulling-ip-in-decimal-format/273948/5 "2021-05-25T18:22:21Z")

</div>

I tested above just with stdin and stdout, and it works fine as it should be, but with proper jdbc input and elasticsearch output, I get 0.0.0.0 for all values.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 25, 2021, 6:44pm UTC](https://discuss.elastic.co/t/jdbc-logstash-module-pulling-ip-in-decimal-format/273948/6 "2021-05-25T18:44:22Z")

</div>

> [@tushar.bansal](#):
>
> 0.0.0.0

That would suggest event.get("IPv4").to\_i is returning zero.

If you are running on the command line try adding

```
puts "IPv4 is #{IPv4}"

```

after the event.get. Are you sure it is IPv4 and not, say, IPV4?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 22, 2021, 6:45pm UTC](https://discuss.elastic.co/t/jdbc-logstash-module-pulling-ip-in-decimal-format/273948/7 "2021-06-22T18:45:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.