# Question: Can I add the IP that issued a command to that command?
**URL:** https://discuss.elastic.co/t/question-can-i-add-the-ip-that-issued-a-command-to-that-command/294932
**Category:** Beats
**Tags:** auditbeat
**Created:** [January 20, 2022, 10:47am UTC](https://discuss.elastic.co/t/question-can-i-add-the-ip-that-issued-a-command-to-that-command/294932 "2022-01-20T10:47:09Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@ziv1](https://discuss.elastic.co/u/ziv1)
#### Post date: [January 20, 2022, 10:47am UTC](https://discuss.elastic.co/t/question-can-i-add-the-ip-that-issued-a-command-to-that-command/294932/1 "2022-01-20T10:47:09Z")
Hi,
Context: auditbeat on RHEL, auditd module
Ideally, I would like to remove a ton of fields that are of no use to a human being (not related to this topic), and add a field that would show me the IP that issued a given command.
Example:
1. user issues "somecommand.sh"
2. Audit log will show (desired result): [host-command-issued-on][user-IP][command-with-args]
(this is a pseudo audit record, just to show the desired IP part of the result)
Unfortunately, though I saw there was an option to add custom fields, I cannot find anything on them being based on custom code, and if I just add "source.ip", it doesn't catch anything (I assume because that field does not exist for these entries).
Is there a way of doing this?
If there's a built-in way of doing it that would be ideal, but if the way is something that lets me add a field based on custom code that will also work, as I do have some sh code that can link an IP to a PID... Provided it can be fed said PID.
Thanks,
Ziv.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 17, 2022, 12:47pm UTC](https://discuss.elastic.co/t/question-can-i-add-the-ip-that-issued-a-command-to-that-command/294932/2 "2022-02-17T12:47:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.