# Redis filter/mutate for LogStash

**URL:** <https://discuss.elastic.co/t/redis-filter-mutate-for-logstash/27285>\
**Category:** Logstash\
**Created:** [August 12, 2015, 7:20pm UTC](https://discuss.elastic.co/t/redis-filter-mutate-for-logstash/27285 "2015-08-12T19:20:29Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sesha\_Narahari](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@Sesha\_Narahari](https://discuss.elastic.co/u/Sesha_Narahari)\
**Post date:** [August 12, 2015, 7:20pm UTC](https://discuss.elastic.co/t/redis-filter-mutate-for-logstash/27285/1 "2015-08-12T19:20:29Z")

</div>

I would like to use Redis as a cache, look up key:value data to enrich messages in a mutate filter. An example would be IP:MAC association. The pipeline looks like:

Input from Redis -\> Filter/Mutate with regex/grok, enrich with data looked up from Redis -\> Output to ElasticSearch.

Any pointers? Write a custom filter?

There appears to be a filter for DNS lookup.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 12, 2015, 10:52pm UTC](https://discuss.elastic.co/t/redis-filter-mutate-for-logstash/27285/2 "2015-08-12T22:52:53Z")

</div>

You'd have to DIY here.

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [August 13, 2015, 12:28am UTC](https://discuss.elastic.co/t/redis-filter-mutate-for-logstash/27285/3 "2015-08-13T00:28:15Z")

</div>

A Redis filter could be written, or requested. There's already an elasticsearch filter.

—Aaron

---

<div class="post-metadata">

**Author:** ![Sesha\_Narahari](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@Sesha\_Narahari](https://discuss.elastic.co/u/Sesha_Narahari)\
**Post date:** [August 13, 2015, 12:32am UTC](https://discuss.elastic.co/t/redis-filter-mutate-for-logstash/27285/4 "2015-08-13T00:32:43Z")

</div>

Thanks for the replies. @theuntergeek by request do you mean I should file a Jira ticket?

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [August 13, 2015, 1:28am UTC](https://discuss.elastic.co/t/redis-filter-mutate-for-logstash/27285/5 "2015-08-13T01:28:27Z")

</div>

JIRA is deprecated. A request to the Logstash team can be made at [github.com/elastic/logstash](http://github.com/elastic/logstash)

Just making a request does not mean it will become available soon. But making one may alert the community to the desire, and perhaps someone will write it before the Logstash team can.

Chances are you'll get what you want sooner if you write it yourself.

—Aaron

---

<div class="post-metadata">

**Author:** ![Sesha\_Narahari](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@Sesha\_Narahari](https://discuss.elastic.co/u/Sesha_Narahari)\
**Post date:** [August 13, 2015, 2:19am UTC](https://discuss.elastic.co/t/redis-filter-mutate-for-logstash/27285/6 "2015-08-13T02:19:28Z")

</div>

Of course. Thanks @theuntergeek

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/redis-filter-mutate-for-logstash/27285/7 "2017-07-06T05:32:07Z")

</div>