# Logstash Filter - Possibility to exec shell commands? **URL:** \ **Category:** Logstash\ **Created:** [July 24, 2015, 8:01am UTC](https://discuss.elastic.co/t/logstash-filter-possibility-to-exec-shell-commands/26218 "2015-07-24T08:01:33Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![german23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/german23/32/11052_2.png) [@german23](https://discuss.elastic.co/u/german23)\ **Post date:** [July 24, 2015, 8:01am UTC](https://discuss.elastic.co/t/logstash-filter-possibility-to-exec-shell-commands/26218/1 "2015-07-24T08:01:33Z")
Hi guys, i wanted to asked quickly if it is possible in logstash to execute a shell/bash command in the processing line of an event. Background: We wanted to add an field in our events, where an ip address get matched to the corresponding dns name. So far i used the "Resolv.getname" ruby function to solve that problem, unfortunately this only performs an lookup in the reverse lookup zone of the dns server - if there is no ptr entry, this will not return the hostname. While this is working for many of the ip addresses, a big bunch of them dont have an ptr entry at the dns server, so whats required is an forward lookup to still get the hostname of the device. Looking at google, i didnt find any ruby gems that provide such an function, but i got an shell command "nmblookup -A" that would do the job quite good. Can i somehow implement this in logstash to use this command at the time, an event get processed? Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 24, 2015, 9:56am UTC](https://discuss.elastic.co/t/logstash-filter-possibility-to-exec-shell-commands/26218/2 "2015-07-24T09:56:23Z")
> While this is working for many of the ip addresses, a big bunch of them dont have an ptr entry at the dns server, so whats required is an forward lookup to still get the hostname of the device. A forward lookup of an IP address? What do you mean? Does your IP address field sometimes contain a hostname? Or you want NetBIOS lookups rather than DNS lookups? ---
**Author:** ![german23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/german23/32/11052_2.png) [@german23](https://discuss.elastic.co/u/german23)\ **Post date:** [July 24, 2015, 11:04am UTC](https://discuss.elastic.co/t/logstash-filter-possibility-to-exec-shell-commands/26218/3 "2015-07-24T11:04:57Z")
Im sorry if i didnt asked an clear question - yes what the shell command do is to perform an NetBIOS lookup. The IP address field only contains ip addresses. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 24, 2015, 8:17pm UTC](https://discuss.elastic.co/t/logstash-filter-possibility-to-exec-shell-commands/26218/4 "2015-07-24T20:17:56Z")
Apart from writing a custom plugin you can probably use a ruby filter that runs nmblookup and scrapes the result. ---
**Author:** ![german23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/german23/32/11052_2.png) [@german23](https://discuss.elastic.co/u/german23)\ **Post date:** [July 30, 2015, 10:54am UTC](https://discuss.elastic.co/t/logstash-filter-possibility-to-exec-shell-commands/26218/5 "2015-07-30T10:54:34Z")
Because i didnt find an netbios ruby gem , i decided to use the following code: ruby { code =\> " ip = event['src'] begin event['hostname'] = `nmblookup -A #{ip} & WPID=$!; sleep 0.1 && kill $WPID > /dev/null 2>&1` rescue =\> ex event['hostname'] = 'unkown' end " } } The `` just tell ruby to exec the given command in an shell, the command itself runs an netbios name lookup relativ to the given ip. Maybe this could help other guys. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:33am UTC](https://discuss.elastic.co/t/logstash-filter-possibility-to-exec-shell-commands/26218/6 "2017-07-06T05:33:21Z")