# Matching ip address

**URL:** <https://discuss.elastic.co/t/matching-ip-address/325992>\
**Category:** Logstash\
**Created:** [February 20, 2023, 4:01pm UTC](https://discuss.elastic.co/t/matching-ip-address/325992 "2023-02-20T16:01:54Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lalii](https://avatars.discourse-cdn.com/v4/letter/l/848f3c/32.png) [@Lalii](https://discuss.elastic.co/u/Lalii)\
**Post date:** [February 20, 2023, 4:01pm UTC](https://discuss.elastic.co/t/matching-ip-address/325992/1 "2023-02-20T16:01:54Z")

</div>

Hello everyone,

I'm trying to do a condition on IP regex.

Trying to match every IPs

```auto
if [destination.XXX] =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/ {
mutate {
...
}
}

```

I tried the solution from that post but doesnt work :

> [@Only invoke geoip if field is IP](https://discuss.elastic.co/t/only-invoke-geoip-if-field-is-ip/25317):
>
> How do I conditionally invoke geoip if the field is a valid IP address?

Thanks for your help

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 20, 2023, 4:18pm UTC](https://discuss.elastic.co/t/matching-ip-address/325992/2 "2023-02-20T16:18:31Z")

</div>

> [@Lalii](#):
>
> `destination.XXX`

What is the field name? Please share a sample of your message.

In Logstash you access nested fields using `[topLevel][nestedField]` not `[topLevel.nestedField]`

So if your field is a nested json object you need to use `[destination][XXX]`.

---

<div class="post-metadata">

**Author:** ![Lalii](https://avatars.discourse-cdn.com/v4/letter/l/848f3c/32.png) [@Lalii](https://discuss.elastic.co/u/Lalii)\
**Post date:** [February 20, 2023, 4:46pm UTC](https://discuss.elastic.co/t/matching-ip-address/325992/3 "2023-02-20T16:46:25Z")

</div>

Thanks for your answer leandrojmp. Here is a sample :  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dc267871ffbe29bf1914ee80406b48046d3a996a.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/d/1d01a7cc098021e8db850f3a3614d767ea16e0c0.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 20, 2023, 4:49pm UTC](https://discuss.elastic.co/t/matching-ip-address/325992/4 "2023-02-20T16:49:36Z")

</div>

So, it worked or not?

From what you shared you have a geoip working already, it is not clear what is the issue.

---

<div class="post-metadata">

**Author:** ![Lalii](https://avatars.discourse-cdn.com/v4/letter/l/848f3c/32.png) [@Lalii](https://discuss.elastic.co/u/Lalii)\
**Post date:** [February 20, 2023, 4:55pm UTC](https://discuss.elastic.co/t/matching-ip-address/325992/5 "2023-02-20T16:55:01Z")

</div>

That actually doesn't work. I'm doing a reverse DNS request on that field but that regex doesn't match.

I would like to check if the field [destination][domain] contain an IP instead of a dns information.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/8/18cbb0e90ef04dd1dd6dc24c1f3faf3955d6ba5c.png)

Do you know why that doesn't match ?  
Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2023, 4:55pm UTC](https://discuss.elastic.co/t/matching-ip-address/325992/6 "2023-03-20T16:55:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.