# Logstash output
**URL:** https://discuss.elastic.co/t/logstash-output/375237
**Category:** Logstash
**Created:** [February 28, 2025, 8:11pm UTC](https://discuss.elastic.co/t/logstash-output/375237 "2025-02-28T20:11:46Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@JosephR](https://discuss.elastic.co/u/JosephR)
#### Post date: [February 28, 2025, 8:11pm UTC](https://discuss.elastic.co/t/logstash-output/375237/1 "2025-02-28T20:11:46Z")
I wrote a conf file and when it reads my ip addresses from the DB it outputs them as an integer instead of the ip address.
I tried to do a mutate like the following:
filter {
mutate {
convert =\> { "sourceipv4" =\> "string" }
}
}
But it will still just output it to a string when I run it just in my console to see what the data going into elastic will be.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [February 28, 2025, 8:20pm UTC](https://discuss.elastic.co/t/logstash-output/375237/2 "2025-02-28T20:20:34Z")
What you are trying to achieve? It is not clear.
Can you share the output you are getting?
---
### Author:  [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [February 28, 2025, 8:40pm UTC](https://discuss.elastic.co/t/logstash-output/375237/3 "2025-02-28T20:40:17Z")
> [@JosephR](#):
>
> reads my ip addresses from _the DB_
Read from which database? (Oracle, MSQL, mysql, .... )
What type is that column in the database?
---
### Author:  [@JosephR](https://discuss.elastic.co/u/JosephR)
#### Post date: [February 28, 2025, 8:56pm UTC](https://discuss.elastic.co/t/logstash-output/375237/4 "2025-02-28T20:56:09Z")
For instance I am trying to get the sourceipv4 from a ms sql DB and when logstash parses it it comes out like -1979695601 instead of an ip address.
This is the filter I am trying to use to get them back to IP addresses.
filter {
mutate {
convert =\> {
"targetipv4" =\> "string"
"sourceipv4" =\> "string"
"analyzeripv4" =\> "string"
}
}
grok {
match =\> {
"targetipv4" =\> "%{IPV4:targetipv4}"
"sourceipv4" =\> "%{IPV4:sourceipv4}"
"analyzeripv4" =\> "%{IPV4:analyzeripv4}"
}
}
}
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [February 28, 2025, 9:03pm UTC](https://discuss.elastic.co/t/logstash-output/375237/5 "2025-02-28T21:03:56Z")
> [@JosephR](#):
>
> For instance I am trying to get the sourceipv4 from a ms sql DB and when logstash parses it it comes out like -1979695601 instead of an ip address.
You would need to provide more context on how your pipeline looks like, what filters do you have, how the source field looks like.
The filters you shared will not work because `-1979695601` is not a valid IP address, so the grok filter will fail.
---
### Author:  [@JosephR](https://discuss.elastic.co/u/JosephR)
#### Post date: [February 28, 2025, 9:07pm UTC](https://discuss.elastic.co/t/logstash-output/375237/6 "2025-02-28T21:07:42Z")
It originally was an IP address but when logstash brings the data over it is converting it to an integer. I wish I could share the outputy let me try to sanatize it and I will.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [February 28, 2025, 9:09pm UTC](https://discuss.elastic.co/t/logstash-output/375237/7 "2025-02-28T21:09:34Z")
> [@JosephR](#):
>
> It originally was an IP address but when logstash brings the data over it is converting it to an integer.
This does not sound right, as far as I know Logstash does not converts anything unless told to do so, but I'm not sure what input and filters you are using.
You will need to provide how the full configuration looks like.
Also, can you show some examples on how the value for those columns looks like in the MSSQL database?
---
### Author:  [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [February 28, 2025, 9:23pm UTC](https://discuss.elastic.co/t/logstash-output/375237/8 "2025-02-28T21:23:56Z")
> [@JosephR](#):
>
> -1979695601
Funnily enough, positive 1979695601 has a 31 bit representation, with leading 0.
So -1979695601 is 32 bits, leading bit one.
An IPv4 address is 32 bits.
--\>
I dont think an IPaddress is being output by MSSQL. I don't believe there is a native IPaddress type in MSSQL, it can be represented lots of ways, one of which is a 32 bit integer.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [February 28, 2025, 10:23pm UTC](https://discuss.elastic.co/t/logstash-output/375237/9 "2025-02-28T22:23:50Z")
It looks like that in the source the IP is stored as the integer representation.
So it needs to be converted back to the dotted representation in Logstash.
This probably can be done with a ruby filter a this is a one liner in ruby.
```auto
irb(main):001:0> require 'ipaddr'
=> true
irb(main):002:0> result = IPAddr.new(1979695601, Socket::AF_INET).to_s
=> "117.255.193.241"
irb(main):003:0>
```
This works:
```auto
filter {
mutate {
gsub => ["sourceipv4","-",""]
}
ruby {
code => '
ipv4 = event.get("sourceipv4").to_i
ipv4_converted = IPAddr.new(ipv4, Socket::AF_INET).to_s
event.set("sourceipv4", ipv4_converted)
'
}
}
```
---
### Author:  [@JosephR](https://discuss.elastic.co/u/JosephR)
#### Post date: [March 3, 2025, 12:41pm UTC](https://discuss.elastic.co/t/logstash-output/375237/10 "2025-03-03T12:41:11Z")
Thank you this worked. What would I need to do for it to grab the other 2 that I listed as well?
---
### Author:  [@JosephR](https://discuss.elastic.co/u/JosephR)
#### Post date: [March 3, 2025, 2:09pm UTC](https://discuss.elastic.co/t/logstash-output/375237/11 "2025-03-03T14:09:40Z")
actually I used this and it seems to be working from your starter that you gave me.
```auto
filter {
mutate {
gsub => [
"sourceipv4", "-", "",
"targetipv4", "-", "",
"analyzeripv4", "-", ""
]
}
ruby {
code => '
if event.get("sourceipv4")
ipv4_source = event.get("sourceipv4").to_i
ipv4_converted_source = IPAddr.new(ipv4_source, Socket::AF_INET).to_s
event.set("sourceipv4", ipv4_converted_source)
end
if event.get("targetipv4")
ipv4_target = event.get("targetipv4").to_i
ipv4_converted_target = IPAddr.new(ipv4_target, Socket::AF_INET).to_s
event.set("targetipv4", ipv4_converted_target)
end
if event.get("analyzeripv4")
ipv4_analyzer = event.get("analyzeripv4").to_i
ipv4_converted_analyzer = IPAddr.new(ipv4_analyzer, Socket::AF_INET).to_s
event.set("analyzeripv4", ipv4_converted_analyzer)
end
'
}
```