# Logstash preserve source ip

**URL:** <https://discuss.elastic.co/t/logstash-preserve-source-ip/377463>\
**Category:** Logstash\
**Created:** [April 23, 2025, 8:24pm UTC](https://discuss.elastic.co/t/logstash-preserve-source-ip/377463 "2025-04-23T20:24:09Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![omoroka](https://avatars.discourse-cdn.com/v4/letter/o/7bcc69/32.png) [@omoroka](https://discuss.elastic.co/u/omoroka)\
**Post date:** [April 23, 2025, 8:24pm UTC](https://discuss.elastic.co/t/logstash-preserve-source-ip/377463/1 "2025-04-23T20:24:09Z")

</div>

Hi,  
I have a logstash server running on linux and this server is collecting logs from various devices like storages, switches, firewalls etc.  
All device send logs to the logstash servers 514 port, most of them is fine but there are storage devices and firewalls from various manufacturers, that has limited log sending options: only the host. The port is 514/udp (or tcp) is hardcoded, no other options.

I have to sort these devices by the original IP addresses, but the messages doesn't contain the IP addresses, only the message and timestamp.

I would like to add the devices' IP address to the log (for example add a field with grok to a json log), but I couldn't find any variable that contains that information. Tried with "codec =\> rubydebug" but no luck (message and timestamp appeared in the messages, but no IP)  
Tried the [host][ip] in line codec's custom format in a million combination (i.e. %{host}, %{[host]}, etc.) but all show in log as a string, but definitly not IP address.

Is there any other way to add the source IP to the log message?

Thank you for your help!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 23, 2025, 10:31pm UTC](https://discuss.elastic.co/t/logstash-preserve-source-ip/377463/2 "2025-04-23T22:31:28Z")

</div>

What input are you using to receive the data?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [April 23, 2025, 11:24pm UTC](https://discuss.elastic.co/t/logstash-preserve-source-ip/377463/3 "2025-04-23T23:24:47Z")

</div>

As Badge mentioned, if you are using syslog plugin, there should be the logsource field together with priority, severity, host.

You can manually add source.ip base on some criteria:

```auto
if [somefield]=="value" 
{
 mutate { add_field => { "[source][ip]" => "192.168.1.11" }  
}

```

If you want [source][ip] as IP field/data type in ES, then you have to create/change index template with [source][ip] as IP field type. GEO structure is optional.

---

<div class="post-metadata">

**Author:** ![omoroka](https://avatars.discourse-cdn.com/v4/letter/o/7bcc69/32.png) [@omoroka](https://discuss.elastic.co/u/omoroka)\
**Post date:** [April 24, 2025, 5:48am UTC](https://discuss.elastic.co/t/logstash-preserve-source-ip/377463/4 "2025-04-24T05:48:44Z")

</div>

Hello,

I'm using the "syslog" input type.

There is no such field "logsource", this is a message:

```auto
{
          "type" => "syslog",
      "@version" => "1",
       "message" => "113 <86>1 2025-04-23T22:17:01+02:00 nginx-server CRON 49801 - - pam_unix(cron:session): session closed for user roo
t",
    "@timestamp" => 2025-04-23T20:17:02.185654015Z,
         "event" => {
        "original" => "113 <86>1 2025-04-23T22:17:01+02:00 nginx-server CRON 49801 - - pam_unix(cron:session): session closed for user r
oot"
    }
}

```

Currently a simple pipeline that records the message:

```auto
input
{
  tcp
  {
    port => 5514
    mode => "server"
    type => syslog
  }
}

output
{
  file
  {
    path => "/log/debug.log"
    codec => rubydebug
  }
}

```

Also, the IP address of the devices is unknown to me, added or removed by dedicated teams (network, hw/storage, etc.). CMDB is the only place where the devices list is maintanined, but it has no API to query.  
Change the configuration every time when a device is added/modified/removed would be a bit difficult.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [April 24, 2025, 7:47am UTC](https://discuss.elastic.co/t/logstash-preserve-source-ip/377463/5 "2025-04-24T07:47:28Z")

</div>

Can you replace the input with this and show results?

```auto
input {
  syslog {
    port => 5514
    type => "syslog"
  }
}

```

---

<div class="post-metadata">

**Author:** ![omoroka](https://avatars.discourse-cdn.com/v4/letter/o/7bcc69/32.png) [@omoroka](https://discuss.elastic.co/u/omoroka)\
**Post date:** [April 24, 2025, 10:03am UTC](https://discuss.elastic.co/t/logstash-preserve-source-ip/377463/6 "2025-04-24T10:03:56Z")

</div>

Thank you, replacing "tcp" with "syslog" worked in "input" section.  
Now the IP address is available as the "ip" field!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 24, 2025, 12:17pm UTC](https://discuss.elastic.co/t/logstash-preserve-source-ip/377463/7 "2025-04-24T12:17:29Z")

</div>

If for some reason (e.g. needing TLS support) you had to continue with the tcp input then you can get the source ip address from a field under [@metadata]. It is documented [here](https://www.elastic.co/docs/reference/logstash/plugins/plugins-inputs-tcp#plugins-inputs-tcp-ecs_metadata) (and the location varies depending on your ECS comatability level).