# Splitting IP addresses

**URL:** <https://discuss.elastic.co/t/splitting-ip-addresses/126117>\
**Category:** Logstash\
**Created:** [March 29, 2018, 4:06pm UTC](https://discuss.elastic.co/t/splitting-ip-addresses/126117 "2018-03-29T16:06:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ecamero2](https://avatars.discourse-cdn.com/v4/letter/e/258eb7/32.png) [@ecamero2](https://discuss.elastic.co/u/ecamero2)\
**Post date:** [March 29, 2018, 4:06pm UTC](https://discuss.elastic.co/t/splitting-ip-addresses/126117/1 "2018-03-29T16:06:09Z")

</div>

Good Morning,

I have a need to remove part of a field if it exists. I have a field that contains either one or two ip addresses:

ie: "1.2.3.4" OR "1.2.3.4,5.6.7.8"

I only want to retain the first address (before the comma) if there is two. This is my current config:

```
 if [auth_info][ipaddress] =~ "," {
    grok {
        match => { "[auth_info][ipaddress]" => "%{DATA:[auth_info][ipaddress]}," }
    }
 }

```

But it is never even getting through the conditional (no events are hitting the grok)

Any ideas?

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 29, 2018, 6:02pm UTC](https://discuss.elastic.co/t/splitting-ip-addresses/126117/2 "2018-03-29T18:02:17Z")

</div>

the right-hand side of your expression is a literal string, not a pattern; we should be more informative when encountering this, because a value will _never_ "match" a literal string.

I believe you are looking for:

```auto
if [auth_info][ipaddress] =~ /,/ {
  # ...
}

```

What version of Logstash? I'd like to make sure we catch this and provide a useful error message in the future.

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 29, 2018, 6:14pm UTC](https://discuss.elastic.co/t/splitting-ip-addresses/126117/3 "2018-03-29T18:14:07Z")

</div>

You may also be better off performance-wise using the [`gsub` directive](https://www.elastic.co/guide/en/logstash/6.2/plugins-filters-mutate.html#plugins-filters-mutate-gsub) of the `mutate` filter:

```auto
filter {
  if [auth_info][ipaddress] =~ /,/ {
    mutate {
      gsub => [
        "[auth_info][ipaddress]", ",.*$", ""
      ]
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2018, 6:14pm UTC](https://discuss.elastic.co/t/splitting-ip-addresses/126117/4 "2018-04-26T18:14:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.