# Logstash filter to match IP's

**URL:** <https://discuss.elastic.co/t/logstash-filter-to-match-ips/41517>\
**Category:** Logstash\
**Created:** [February 11, 2016, 4:26pm UTC](https://discuss.elastic.co/t/logstash-filter-to-match-ips/41517 "2016-02-11T16:26:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [February 11, 2016, 4:26pm UTC](https://discuss.elastic.co/t/logstash-filter-to-match-ips/41517/1 "2016-02-11T16:26:36Z")

</div>

How to drop the events which are having the source IP with 10. **.**.\*\* (starts with 10 series).

I have tried the below code by using regular expression but it is not working, kindly help me to find the correct solution.

filter {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{WORD:status} %{WORD:auth\_method} for %{USER:username} from %{IP:src\_ip} port %{POSINT:port} ssh2" }  
}  
if ([src\_ip] == /10.([0-9]{1,3}).([0-9]{1,3}).([0-9]{1,3})$/)  
{  
drop{}  
}

}

---

<div class="post-metadata">

**Author:** ![l1carter](https://avatars.discourse-cdn.com/v4/letter/l/74df32/32.png) [@l1carter](https://discuss.elastic.co/u/l1carter)\
**Post date:** [February 11, 2016, 5:25pm UTC](https://discuss.elastic.co/t/logstash-filter-to-match-ips/41517/2 "2016-02-11T17:25:55Z")

</div>

just tested:

/10.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/

on [http://www.regexpal.com](http://www.regexpal.com)

should match real IP's that start with 10.x.x.x but not things like 10.355.1.1 which isn't a valid IP.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 14, 2016, 2:42pm UTC](https://discuss.elastic.co/t/logstash-filter-to-match-ips/41517/3 "2016-02-14T14:42:48Z")

</div>

> if ([src\_ip] == /10.([0-9]{1,3}).([0-9]{1,3}).([0-9]{1,3})$/)  
> {  
> drop{}  
> }

[As documented](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals), use `=~` and not `==` for regular expression matches. Other comments:

- You should anchor your expression to the beginning of the string.
- Periods should be escaped.
- There's little point in matching the whole IP address. All you need to know is if the string begins with "10.".
- For less trivial IP patterns consider using the [cidr filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-cidr.html).

Hence, if you want to stick with a simple conditional this is sufficient:

```
if [src_ip] =~ /^10\./

```

---

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [February 16, 2016, 10:46am UTC](https://discuss.elastic.co/t/logstash-filter-to-match-ips/41517/4 "2016-02-16T10:46:33Z")

</div>

Thanks Magnus

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:11am UTC](https://discuss.elastic.co/t/logstash-filter-to-match-ips/41517/5 "2017-07-06T05:11:15Z")

</div>