# Source hostname instead of source\_ip **URL:** https://discuss.elastic.co/t/source-hostname-instead-of-source-ip/76852 **Category:** Beats **Tags:** packetbeat **Created:** [February 28, 2017, 7:00pm UTC](https://discuss.elastic.co/t/source-hostname-instead-of-source-ip/76852 "2017-02-28T19:00:32Z") **Posts on this page:** 8 **Page:** 1
### Author: ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz) #### Post date: [February 28, 2017, 7:00pm UTC](https://discuss.elastic.co/t/source-hostname-instead-of-source-ip/76852/1 "2017-02-28T19:00:32Z")
Hello, is there any way to have a source\_hostname instead of source\_ip. I am looking to monitor traffic data and it seems there is only a choice by IP but hostname would be more useful since we wouldn't have to keep track of every IP. Thanks, Kenny ---
### Author: ![jkuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkuang/32/72637_2.png) [@jkuang](https://discuss.elastic.co/u/jkuang) #### Post date: [February 28, 2017, 7:24pm UTC](https://discuss.elastic.co/t/source-hostname-instead-of-source-ip/76852/2 "2017-02-28T19:24:13Z")
Are you referring to the monitoring module that comes with X-Pack? ---
### Author: ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz) #### Post date: [February 28, 2017, 7:27pm UTC](https://discuss.elastic.co/t/source-hostname-instead-of-source-ip/76852/3 "2017-02-28T19:27:45Z")
no packetbeat, ![](https://us1.discourse-cdn.com/elastic/original/2X/6/6b062e0f9e019103b0481d3ec5380f01cde78138.png) i would like to use hostnames instead of IP's ---
### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh) #### Post date: [March 1, 2017, 4:14pm UTC](https://discuss.elastic.co/t/source-hostname-instead-of-source-ip/76852/4 "2017-03-01T16:14:16Z")
What hostname would you like to see? What protocols are you talking about here? There is a reverse lookup filter in Logstash that can add hostnames to events. ---
### Author: ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz) #### Post date: [March 1, 2017, 4:27pm UTC](https://discuss.elastic.co/t/source-hostname-instead-of-source-ip/76852/5 "2017-03-01T16:27:23Z")
how can this be done through logstash? is there a way to do this through elasticsearch as i am not sending any packetbeats to logstash. ---
### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh) #### Post date: [March 1, 2017, 4:35pm UTC](https://discuss.elastic.co/t/source-hostname-instead-of-source-ip/76852/6 "2017-03-01T16:35:37Z")
You need Logstash for that. See [https://www.elastic.co/guide/en/logstash/current/plugins-filters-dns.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dns.html) ---
### Author: ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz) #### Post date: [March 1, 2017, 4:37pm UTC](https://discuss.elastic.co/t/source-hostname-instead-of-source-ip/76852/7 "2017-03-01T16:37:10Z")
ok, ill give this a shot thanks! ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [March 29, 2017, 4:37pm UTC](https://discuss.elastic.co/t/source-hostname-instead-of-source-ip/76852/8 "2017-03-29T16:37:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.