# Private IP Address

**URL:** <https://discuss.elastic.co/t/private-ip-address/94589>\
**Category:** Logstash\
**Created:** [July 26, 2017, 7:54am UTC](https://discuss.elastic.co/t/private-ip-address/94589 "2017-07-26T07:54:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bondo](https://avatars.discourse-cdn.com/v4/letter/b/ad7895/32.png) [@Bondo](https://discuss.elastic.co/u/Bondo)\
**Post date:** [July 26, 2017, 7:54am UTC](https://discuss.elastic.co/t/private-ip-address/94589/1 "2017-07-26T07:54:09Z")

</div>

I am trying to enter in an IF statement to preset the geo information based on some internal IPs, but I'm not sure what the syntax needs to be when listing the range. The example below is for any IP with a 10.x.x.x address, but my range is 10.3.64.x - 10.3.127.x

if [c-ip] =~ /^10./ {  
mutate { replace =\> { "[geoip][timezone]" =\> "Pacific/Auckland" } }  
mutate { replace =\> { "[geoip][country\_name]" =\> "Merica" } }  
mutate { replace =\> { "[geoip][country\_code2]" =\> "UO" } }  
mutate { replace =\> { "[geoip][country\_code3]" =\> "UoO" } }  
mutate { remove\_field =\> ["[geoip][location]" ] }  
mutate { add\_field =\> { "[geoip][location]" =\> "170.525" } }  
mutate { add\_field =\> { "[geoip][location]" =\> "-45.865" } }  
mutate { convert =\> ["[geoip][location]", "float" ] }  
mutate { replace =\> ["[geoip][latitude]", -45.856 ] }  
mutate { convert =\> ["[geoip][latitude]", "float" ] }  
mutate { replace =\> ["[geoip][longitude]", 170.525 ] }  
mutate { convert =\> ["[geoip][longitude]", "float" ] }  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 26, 2017, 7:57am UTC](https://discuss.elastic.co/t/private-ip-address/94589/2 "2017-07-26T07:57:59Z")

</div>

Use a cidr filter to set a tag when the `c-ip` field matches a particular CIDR expression, then check for he presence of that tag in your conditional.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 23, 2017, 7:58am UTC](https://discuss.elastic.co/t/private-ip-address/94589/3 "2017-08-23T07:58:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.