# Logstash filter conditions does not work,how to get The real user ipaddress from access log of Apache?

**URL:** <https://discuss.elastic.co/t/logstash-filter-conditions-does-not-work-how-to-get-the-real-user-ipaddress-from-access-log-of-apache/101091>\
**Category:** Logstash\
**Created:** [September 20, 2017, 3:04am UTC](https://discuss.elastic.co/t/logstash-filter-conditions-does-not-work-how-to-get-the-real-user-ipaddress-from-access-log-of-apache/101091 "2017-09-20T03:04:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jagerzhang](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@jagerzhang](https://discuss.elastic.co/u/jagerzhang)\
**Post date:** [September 20, 2017, 3:04am UTC](https://discuss.elastic.co/t/logstash-filter-conditions-does-not-work-how-to-get-the-real-user-ipaddress-from-access-log-of-apache/101091/1 "2017-09-20T03:04:38Z")

</div>

Logstash filter conditions does not work， as follows：

```auto
filter {
      json {
            source => "message"
        }

        if "%{client_ip}" == "-" {
            mutate {
                remove_field => "client_ip"
                add_field => { "client_ip" => "0.0.0.0" }
            }
        }
}

```

when %{client\_ip} == "-" I want replace it to 0.0.0.0 ，but it does not work，still output like ：

```auto
{
              "method" => "GET",
     "body_bytes_sent" => "182",
              "source" => "/data/wwwlogs/access_20170920.log",
             "message" => "{\"@timestamp\":\"2017-09-20T12:29:01+0800\",\"client_ip\":\"-\",\"request_time\":0,\"status\":200,\"url\":\"/web/123.gif\",\"method\":\"GET\",\"http_host\":\"www.test.com\",\"server_ip\":\"192.168.1.10\",\"http_referer\":\"-\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36\",\"body_bytes_sent\":\"182\",\"total_bytes_sent\":\"482\"}",
           "http_host" => "www.test.com",
                 "url" => "/web/123.gif",
     "http_user_agent" => "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36",
          "@timestamp" => 2017-09-20T04:29:01.000Z,
        "request_time" => 0,
        "http_referer" => "-",
    "total_bytes_sent" => "482",
                "beat" => {},
           "server_ip" => "192.168.1.10",
           "client_ip" => "-",
              "status" => 200
}

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 20, 2017, 5:21am UTC](https://discuss.elastic.co/t/logstash-filter-conditions-does-not-work-how-to-get-the-real-user-ipaddress-from-access-log-of-apache/101091/2 "2017-09-20T05:21:21Z")

</div>

Use `if [client_ip] ...` instead. See [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html).

---

<div class="post-metadata">

**Author:** ![jagerzhang](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@jagerzhang](https://discuss.elastic.co/u/jagerzhang)\
**Post date:** [September 20, 2017, 7:39am UTC](https://discuss.elastic.co/t/logstash-filter-conditions-does-not-work-how-to-get-the-real-user-ipaddress-from-access-log-of-apache/101091/3 "2017-09-20T07:39:28Z")

</div>

it has resolved!

```auto
if [client_ip] == "-" {
     replace => { "client_ip" => "0.0.0.0" }
}

```

---

<div class="post-metadata">

**Author:** ![jagerzhang](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@jagerzhang](https://discuss.elastic.co/u/jagerzhang)\
**Post date:** [September 20, 2017, 7:40am UTC](https://discuss.elastic.co/t/logstash-filter-conditions-does-not-work-how-to-get-the-real-user-ipaddress-from-access-log-of-apache/101091/4 "2017-09-20T07:40:17Z")

</div>

Tks 😁

---

<div class="post-metadata">

**Author:** ![jagerzhang](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@jagerzhang](https://discuss.elastic.co/u/jagerzhang)\
**Post date:** [September 20, 2017, 7:51am UTC](https://discuss.elastic.co/t/logstash-filter-conditions-does-not-work-how-to-get-the-real-user-ipaddress-from-access-log-of-apache/101091/5 "2017-09-20T07:51:52Z")

</div>

For get the real client ip, we could editor the configuration of Apache and logstash like this :

Apache

```auto
#add client_ip and direct_ip

LogFormat "{ \
           \"@timestamp\": \"%{%Y-%m-%dT%H:%M:%S%z}t\", \

           \"client_ip\": \"%{X-Forwarded-For}i\", \
           \"direct_ip\": \"%a\", \
          
            \"request_time\": %T, \
           \"status\": %>s, \
           \"url\": \"%U%q\", \
           \"method\": \"%m\", \
           \"http_host\": \"%{Host}i\", \
           \"server_ip\": \"%A\", \
           \"http_referer\": \"%{Referer}i\", \
           \"http_user_agent\": \"%{User-agent}i\", \
	   \"body_bytes_sent\": \"%B\", \
	   \"total_bytes_sent\": \"%O\" \
 }" access_log_json

CustomLog "|/usr/local/apache2/bin/rotatelogs -l /data/wwwlogs/access_%Y%m%d.log 86400" access_log_json

```

logstash filter plugin：

```auto
mutate {  
      json {
            source => "message"
        }
        mutate {
            split => ["client_ip", ","]
        }

        mutate {
            replace => { "client_ip" => "%{client_ip[0]}" }
        }

        if [client_ip] == "-" {
                mutate {
                    replace => { "client_ip" => "%{direct_ip}" }
                }
        }
        mutate {
            remove_field => "direct_ip"
        }

    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2017, 7:52am UTC](https://discuss.elastic.co/t/logstash-filter-conditions-does-not-work-how-to-get-the-real-user-ipaddress-from-access-log-of-apache/101091/6 "2017-10-18T07:52:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.