# Logstash failed to differentiate log filtering based on data source IP address

**URL:** <https://discuss.elastic.co/t/logstash-failed-to-differentiate-log-filtering-based-on-data-source-ip-address/352471>\
**Category:** Logstash\
**Created:** [February 4, 2024, 3:44am UTC](https://discuss.elastic.co/t/logstash-failed-to-differentiate-log-filtering-based-on-data-source-ip-address/352471 "2024-02-04T03:44:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pacoxpk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pacoxpk/32/131393_2.png) [@pacoxpk](https://discuss.elastic.co/u/pacoxpk)\
**Post date:** [February 4, 2024, 3:44am UTC](https://discuss.elastic.co/t/logstash-failed-to-differentiate-log-filtering-based-on-data-source-ip-address/352471/1 "2024-02-04T03:44:50Z")

</div>

Send logs from multiple systems through syslog to logstash, which can receive logs normally. In order to distinguish logs sent from different systems, it is necessary to distinguish them based on the IP address of the data source. As long as if [host]="10.1.100.9" is added, the condition does not hold, and debug logs cannot continue to be output. If this check statement is not added, debug logs can be output normally. In version 6.4 of logstash, using the same configuration, debug logs can be output normally, The current version of logstash is 8.12.0, and the following is the configuration of logstack.conf

```auto
input{
 syslog{
   port => 514
 }
}
output {
   if [host] == "10.1.100.9" {
     stdout {
         codec => rubydebug
     }
  }
}

```

The following is the original log output:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a58c56375c5d28147d6b6d8c1ef76226dc1cbc0b.png)

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [February 4, 2024, 6:39am UTC](https://discuss.elastic.co/t/logstash-failed-to-differentiate-log-filtering-based-on-data-source-ip-address/352471/2 "2024-02-04T06:39:13Z")

</div>

Welcome to the community.

Please use [the nested fields](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references). In your case should be:  
`if [host][ip] == "10.1.100.9" {`

---

<div class="post-metadata">

**Author:** ![pacoxpk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pacoxpk/32/131393_2.png) [@pacoxpk](https://discuss.elastic.co/u/pacoxpk)\
**Post date:** [February 4, 2024, 7:03am UTC](https://discuss.elastic.co/t/logstash-failed-to-differentiate-log-filtering-based-on-data-source-ip-address/352471/3 "2024-02-04T07:03:56Z")

</div>

Thank you very much for your answer. Based on the method you provided, we have perfectly solved this problem 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2024, 7:04am UTC](https://discuss.elastic.co/t/logstash-failed-to-differentiate-log-filtering-based-on-data-source-ip-address/352471/4 "2024-03-03T07:04:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.