# Match a IP and add a Name

**URL:** https://discuss.elastic.co/t/match-a-ip-and-add-a-name/101436
**Category:** Logstash
**Created:** [September 22, 2017, 7:50am UTC](https://discuss.elastic.co/t/match-a-ip-and-add-a-name/101436 "2017-09-22T07:50:54Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![lueneburger](https://avatars.discourse-cdn.com/v4/letter/l/f475e1/32.png) [@lueneburger](https://discuss.elastic.co/u/lueneburger)
#### Post date: [September 22, 2017, 7:50am UTC](https://discuss.elastic.co/t/match-a-ip-and-add-a-name/101436/1 "2017-09-22T07:50:54Z")

</div>

Hi everyone,

short question:

is it possible to match the client\_Ip field against a set of ips -\> names?

right now i collect my haproxy logs into ES and can see the client\_IP without any problem, all IPs are whitelisted, so i need to go on my firewall and look into the list, but it would be easier for other ppl, to see the name of the Partner behind the IP.

maybe someone has an idea?

was first thinking about a script with curl to add the named for each document, but...yea could be madness 😃 (index currently only have 3 - 4milion doc. each day)

so maybe something fancy within logstash, that i cant see?

thanks in advance for any idea and help,

Cheers  
Dirk

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 22, 2017, 7:55am UTC](https://discuss.elastic.co/t/match-a-ip-and-add-a-name/101436/2 "2017-09-22T07:55:24Z")

</div>

If you use the translate filter you can do that during ingestion, or you could use the Elasticsearch filter to do a lookup of in an index where you may have that info and do the same thing.

---

<div class="post-metadata">

### Author: ![lueneburger](https://avatars.discourse-cdn.com/v4/letter/l/f475e1/32.png) [@lueneburger](https://discuss.elastic.co/u/lueneburger)
#### Post date: [September 22, 2017, 8:03am UTC](https://discuss.elastic.co/t/match-a-ip-and-add-a-name/101436/3 "2017-09-22T08:03:33Z")

</div>

Hi @warkolm,

things that i never heard of 😃  
will take a look thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 20, 2017, 8:03am UTC](https://discuss.elastic.co/t/match-a-ip-and-add-a-name/101436/4 "2017-10-20T08:03:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.