# Private ip map from dictionary used in processor-dns

**URL:** <https://discuss.elastic.co/t/private-ip-map-from-dictionary-used-in-processor-dns/199342>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 13, 2019, 2:30am UTC](https://discuss.elastic.co/t/private-ip-map-from-dictionary-used-in-processor-dns/199342 "2019-09-13T02:30:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ppafford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppafford/32/36533_2.png) [@ppafford](https://discuss.elastic.co/u/ppafford)\
**Post date:** [September 13, 2019, 2:30am UTC](https://discuss.elastic.co/t/private-ip-map-from-dictionary-used-in-processor-dns/199342/1 "2019-09-13T02:30:08Z")

</div>

> **[DNS Reverse Lookup | Filebeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/processor-dns.html)**

> [@Private ip geoip from dictionary](https://discuss.elastic.co/t/private-ip-geoip-from-dictionary/156763):
>
> Related question [Private ip geoip JSON object / structure and some questions](https://discuss.elastic.co/t/private-ip-geoip-json-object-structure-and-some-questions/156555) but this is option 2 some other useful resources [https://cinhtau.net/2018/01/26/enrich-geopoints/](https://cinhtau.net/2018/01/26/enrich-geopoints/)[https://www.elastic.co/assets/bltc44f784ba5a1fc46/logstash-enrichment-slides.pdf](https://www.elastic.co/assets/bltc44f784ba5a1fc46/logstash-enrichment-slides.pdf)[https://www.elastic.co/blog/elasticsearch-data-enrichment-with-logstash-a-few-security-examples](https://www.elastic.co/blog/elasticsearch-data-enrichment-with-logstash-a-few-security-examples)[Create Custom geoip database for Logstash 5.2](https://discuss.elastic.co/t/create-custom-geoip-database-for-logstash-5-2/79473/20) my logstash config input { redis { data\_type =\> "list" key =\> "filebeat" host =\> "h…

the two links above are what I'd like to combine and basically take LogStash out of my pipeline, just have filebeat custom defined processor for dns use the dictionary instead of the name-servers.

is this possible yet?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 11, 2019, 2:30am UTC](https://discuss.elastic.co/t/private-ip-map-from-dictionary-used-in-processor-dns/199342/2 "2019-10-11T02:30:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.