Removes ::ffff: from ip address field


i want to remove ::ffff: from ip address field (like this)

so in logstash i've made this

# Removes ::ffff from IP address
filter {
  if "winlogbeat" in [tags] {
  mutate {
    gsub => ["[event_data][IpAddress]", "::ffff:", ""]

but that does not work, any ideas ?

Thx for help


I think you need to change:


To this:


i've changed and it's really strange sometimes i've ::ffff: and somitimes not

February 1st 2019, 12:42:33.724 ::ffff:

February 1st 2019, 12:42:33.471

i think the filter doen't removes ::ffff; and certain event don't have this ffff.

it's possible ?

The addresses with ::ffff: are mapped ipv6 addresses.

have read here

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.