# Name in place of IP
**URL:** https://discuss.elastic.co/t/name-in-place-of-ip/200937
**Category:** Beats
**Tags:** packetbeat
**Created:** [September 24, 2019, 9:19pm UTC](https://discuss.elastic.co/t/name-in-place-of-ip/200937 "2019-09-24T21:19:31Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [September 24, 2019, 9:19pm UTC](https://discuss.elastic.co/t/name-in-place-of-ip/200937/1 "2019-09-24T21:19:31Z")
is there a way I can convert all IP that are getting register in to elasticsearch as name?
I am just using regular packetbeat configuration and outputting straight to elasticsearch
```
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["elktst10:9200"]
```
---
### Author:  [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)
#### Post date: [September 25, 2019, 6:32am UTC](https://discuss.elastic.co/t/name-in-place-of-ip/200937/2 "2019-09-25T06:32:47Z")
Hi @elasticforme,
You can configure the same in below formats and host should be reachable.
**Examples:**
```
output.elasticsearch:
hosts: ["https://localhost:9200"]
output.elasticsearch:
hosts: ["localhost"]
output.elasticsearch:
hosts: ["http://localhost:9200"]
```
Please do let me know in case of an query in this regard.
Regards,
Harsh Bajaj
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [September 25, 2019, 12:53pm UTC](https://discuss.elastic.co/t/name-in-place-of-ip/200937/3 "2019-09-25T12:53:33Z")
Sorry Harsh, I didn't put my question properly
all the data I get from packetbeat has IP addresses
I would like that to convert to Name and then put it in elasticsearch
is that possible?
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 25, 2019, 1:30pm UTC](https://discuss.elastic.co/t/name-in-place-of-ip/200937/4 "2019-09-25T13:30:39Z")
You cannot directly replace IP addresses with names because fields like `source.ip` and `destination.ip` can only contain IP addresses due to how they have been defined in Elasticsearch.
You could use `source.domain` and `destination.domain` to hold the names. Then you can optionally delete the IP fields.
How do you want to map the IPs to names? Like is this data coming from a reverse DNS lookup? Or a static table?
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [September 25, 2019, 1:51pm UTC](https://discuss.elastic.co/t/name-in-place-of-ip/200937/5 "2019-09-25T13:51:14Z")
> [@andrewkroh](#):
>
> source.dom
I was just woundering if there is any dns filter which can convert this IP to name
for example each event will have source.id and destination.id
and I can do lookup for that IP and save that name.
replacement is not required but can create source.host and destination.host.
I show this filter on documentation but didn't made any sense on how to use it.
filter {
dns {
reverse =\> ["source\_host", "field\_with\_address"]
resolve =\> ["field\_with\_fqdn"]
action =\> "replace"
}
}
is that telling me that when I run packetbet I have to send data to logstash rather then elasticsearch and then process this part?
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [September 26, 2019, 8:28pm UTC](https://discuss.elastic.co/t/name-in-place-of-ip/200937/6 "2019-09-26T20:28:36Z")
Beats have some built-in processors that you can use. Specifically for this use case there is a `dns` processor that does reverse lookups.
```auto
processors:
- dns:
type: reverse
fields:
source.ip: source.domain
destination.ip: destination.domain
```
- [https://www.elastic.co/guide/en/beats/packetbeat/current/defining-processors.html#defining-processors](https://www.elastic.co/guide/en/beats/packetbeat/current/defining-processors.html#defining-processors)
- [https://www.elastic.co/guide/en/beats/packetbeat/current/processor-dns.html](https://www.elastic.co/guide/en/beats/packetbeat/current/processor-dns.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 24, 2019, 8:31pm UTC](https://discuss.elastic.co/t/name-in-place-of-ip/200937/7 "2019-10-24T20:31:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.