# Nginx file\_format incorrect output **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [January 15, 2020, 10:32am UTC](https://discuss.elastic.co/t/nginx-file-format-incorrect-output/215113 "2020-01-15T10:32:56Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![marbro15](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@marbro15](https://discuss.elastic.co/u/marbro15)\ **Post date:** [January 15, 2020, 10:32am UTC](https://discuss.elastic.co/t/nginx-file-format-incorrect-output/215113/1 "2020-01-15T10:32:56Z")
Hello, I have a question about the nginx log\_format. Currently we have the problem, that the source.address in filebeat shows address and ip in one field. For example: ``` "source": { "address": "www.domain.tld 123.123.123.123" }, ``` This is the config of our nginx file\_format (nginx.conf): ``` log_format filebeat '$http_host $remote_addr - $remote_user [$time_local] ' '"$request" $status $bytes_sent ' '"$http_referer" "$http_user_agent" "$request_time"'; ``` We are using the newest nginx filebeat module (master branch) from [https://github.com/elastic/beats/blob/master/filebeat/module/nginx/access/ingest/default.json](https://github.com/elastic/beats/blob/master/filebeat/module/nginx/access/ingest/default.json) We want to split the ip into the field source.ip. Maybe someone can help me? Thank you! Regards! ---
**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Post date:** [January 15, 2020, 10:46am UTC](https://discuss.elastic.co/t/nginx-file-format-incorrect-output/215113/2 "2020-01-15T10:46:36Z")
Hi, This should do the trick ```auto mutate { split => ["address"," "] add_field => { "address" => "%{[address][0]}" } add_field => { "ip" => "%{[address][1]}" } } ``` let me know ---
**Author:** ![marbro15](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@marbro15](https://discuss.elastic.co/u/marbro15)\ **Post date:** [January 15, 2020, 11:20am UTC](https://discuss.elastic.co/t/nginx-file-format-incorrect-output/215113/3 "2020-01-15T11:20:55Z")
Thank you very much! But now I'm stumped where I have to add this function into the default.json ([https://github.com/elastic/beats/blob/master/filebeat/module/nginx/access/ingest/default.json](https://github.com/elastic/beats/blob/master/filebeat/module/nginx/access/ingest/default.json)). ---
**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Post date:** [January 15, 2020, 12:41pm UTC](https://discuss.elastic.co/t/nginx-file-format-incorrect-output/215113/4 "2020-01-15T12:41:41Z")
Hey, are you processing data through elasticsearch with logstash ? ---
**Author:** ![marbro15](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@marbro15](https://discuss.elastic.co/u/marbro15)\ **Post date:** [January 15, 2020, 12:58pm UTC](https://discuss.elastic.co/t/nginx-file-format-incorrect-output/215113/5 "2020-01-15T12:58:47Z")
Hey, yes, that's correct. We're using filebeat on the web node as service with the filebeat nginx module. And in our nginx.conf we're using the file\_format as you can see above. ---
**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Post date:** [January 15, 2020, 1:03pm UTC](https://discuss.elastic.co/t/nginx-file-format-incorrect-output/215113/6 "2020-01-15T13:03:07Z")
So if you use logstash you can actually change this using the filter plugin and the mutate in your logstash [pipeline](https://www.elastic.co/guide/en/logstash/current/pipeline.html) Let me know if you need some more help. ---
**Author:** ![marbro15](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@marbro15](https://discuss.elastic.co/u/marbro15)\ **Post date:** [January 16, 2020, 10:25am UTC](https://discuss.elastic.co/t/nginx-file-format-incorrect-output/215113/7 "2020-01-16T10:25:38Z")
Hello. Unfortunately the issue is still persist. ![issue](https://us1.discourse-cdn.com/elastic/original/3X/0/9/090056814cea5e8392ec336bb42887be75fd0462.png) As you can see, the source.address shows domain and ip. But the source.ip field is empty. But why? I can't add your example in my .json file, because there is no logstash service. We are only using filebeat. My ingest .json file: ``` { "description": "Pipeline for parsing Nginx access logs. Requires the geoip and user_agent plugins.", "processors": [ { "grok": { "field": "message", "patterns": [ "%{NGINX_HOST} - %{DATA:user.name} \\[%{HTTPDATE:nginx.access.time}\\] \"%{DATA:nginx.access.info}\" %{NUMBER:http.response.status_code:long} %{NUMBER:http.response.body.bytes:long} \"%{DATA:http.request.referrer}\" \"%{DATA:user_agent.original}\"" ], "pattern_definitions": { "NGINX_HOST": "(?:%{IP:destination.ip}|%{NGINX_NOTSEPARATOR:destination.domain})(:%{NUMBER:destination.port})?", "NGINX_NOTSEPARATOR": "[^\t ,:]+", "NGINX_ADDRESS_LIST": "(?:%{IP}|%{WORD})(\"?,?\\s*(?:%{IP}|%{WORD}))*" }, "ignore_missing": true } }, { "set": { "field": "error.message", "value": "{{ _ingest.on_failure_message }}" } } ] } ``` Thank you. Regards ---
**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Post date:** [January 16, 2020, 10:52am UTC](https://discuss.elastic.co/t/nginx-file-format-incorrect-output/215113/8 "2020-01-16T10:52:51Z")
Use grok, In your ingest file create another grok after the first one. I can think of something like : source field : source.address (?(\w+\S+))%{SPACE}(?%{IPV4}) This will split the field using space and create 2 fields - DomainName - IP ---
**Author:** ![marbro15](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@marbro15](https://discuss.elastic.co/u/marbro15)\ **Post date:** [January 16, 2020, 12:59pm UTC](https://discuss.elastic.co/t/nginx-file-format-incorrect-output/215113/9 "2020-01-16T12:59:19Z")
Thank you. I have add another grok like this: ``` { "grok": { "field": "source.address", "patterns": [ "(?(\w+\S+))%{SPACE}(?%{IP:source.ip})" ], "ignore_missing": true } }, ``` I think there is some issue, but I can't find the error. The logging isn't working anymore. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 13, 2020, 1:07pm UTC](https://discuss.elastic.co/t/nginx-file-format-incorrect-output/215113/10 "2020-02-13T13:07:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.