# Read/Match Data **URL:** \ **Category:** Logstash\ **Created:** [August 2, 2016, 6:49am UTC](https://discuss.elastic.co/t/read-match-data/56962 "2016-08-02T06:49:03Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Post date:** [August 2, 2016, 6:49am UTC](https://discuss.elastic.co/t/read-match-data/56962/1 "2016-08-02T06:49:03Z")
Hi Elastic, I want to match IP address from below type of data with field, i tried Translate filter but it is not supporting for .txt format, Kindly help me to fix this. I am downloading this from URL, using http\_poller plugin. 185.93.185.235 219.151.8.160 93.174.93.136 [no-reverse-dns-configured.com](http://no-reverse-dns-configured.com) 116.31.116.5 209.58.129.109 113.108.10.31 207.244.70.169 208.100.26.228 [ip228.208-100-26.static.steadfastdns.net](http://ip228.208-100-26.static.steadfastdns.net) 186.119.94.213 220.179.124.181 171.233.202.181 27.255.66.254 115.239.248.72 118.33.99.123 82.78.95.165 [82.78.95.165-static.cluj.rdsnet.ro](http://82.78.95.165-static.cluj.rdsnet.ro) 192.99.236.73 [ip73.ip-192-99-236.net](http://ip73.ip-192-99-236.net) 58.218.204.245 181.138.78.97 [hfc-181-138-78-97.une.net.co](http://hfc-181-138-78-97.une.net.co) 177.98.247.12 [177.98.247.dynamic.adsl.gvt.net.br](http://177.98.247.dynamic.adsl.gvt.net.br) 104.223.17.24 [104.223.17.24.static.quadranet.com](http://104.223.17.24.static.quadranet.com) 109.237.111.108 216.243.31.2 221.194.44.218 121.18.238.19 80.82.70.198 [icsresearch1.plcscan.org](http://icsresearch1.plcscan.org) 179.181.177.125 [179.181.177.125.dynamic.adsl.gvt.net.br](http://179.181.177.125.dynamic.adsl.gvt.net.br) 222.186.51.181 94.102.49.174 [mail.picdown.me](http://mail.picdown.me) 104.193.252.230 [edwardmurphy.clientshostname.com](http://edwardmurphy.clientshostname.com) 169.229.3.91 [researchscan1.EECS.Berkeley.EDU](http://researchscan1.EECS.Berkeley.EDU) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 2, 2016, 8:27am UTC](https://discuss.elastic.co/t/read-match-data/56962/2 "2016-08-02T08:27:06Z")
You're downloading that data with http\_poller and you want to look up the IP addresses using the translate filter? Or you want to use the data downloaded with http\_poller as the lookup table for the translate filter? ---
**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Post date:** [August 2, 2016, 8:54am UTC](https://discuss.elastic.co/t/read-match-data/56962/3 "2016-08-02T08:54:15Z")
Either ways will work for me, Suggest me the best approach. If my log contains this IP it should match ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 2, 2016, 9:05am UTC](https://discuss.elastic.co/t/read-match-data/56962/4 "2016-08-02T09:05:52Z")
Transform the data into something the translate filter understands. You have a space-separated text file so it's not like YAML, JSON, or CSV is vastly different. ---
**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Post date:** [August 2, 2016, 4:51pm UTC](https://discuss.elastic.co/t/read-match-data/56962/5 "2016-08-02T16:51:21Z")
I tried to match the data with below mentioned script, but not getting correct output, at the same time i am able to achieve at grok debugger. ``` input { stdin {codec => json_line} } filter { grok {match => { "message" => "(?.*)\t(?.*)\n(?.*)\t(?.*)\n(?.*)\t(?.*)" } } } output { stdout { codec => rubydebug} } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:45am UTC](https://discuss.elastic.co/t/read-match-data/56962/6 "2017-07-06T04:45:15Z")