# Support for source\_ip\_fieldname in all network input plugins

**URL:** <https://discuss.elastic.co/t/support-for-source-ip-fieldname-in-all-network-input-plugins/161798>\
**Category:** Logstash\
**Created:** [December 21, 2018, 7:34am UTC](https://discuss.elastic.co/t/support-for-source-ip-fieldname-in-all-network-input-plugins/161798 "2018-12-21T07:34:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dss/32/33128_2.png) [@dss](https://discuss.elastic.co/u/dss)\
**Post date:** [December 21, 2018, 7:34am UTC](https://discuss.elastic.co/t/support-for-source-ip-fieldname-in-all-network-input-plugins/161798/1 "2018-12-21T07:34:39Z")

</div>

The [udp input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-udp.html) supports an option `source_ip_fieldname` with a default value of `host` and described as "the name of the field where the source IP address will be stored."

I'd like to begin using ECS fields everywhere possible in my data, and one aspect of the default use of `host` for the field name in which to store the remote log client's IP is that it's a container field in ECS ([https://github.com/elastic/ecs#host](https://github.com/elastic/ecs#host)). So I would ideally like to override `source_ip_fieldname` everywhere to use `host.ip`. The documentation for at least the `tcp` and `syslog` input plugins suggests that `source_ip_fieldname` option is not supported for them. Would just like to request if this option can be implemented in every network input plugin to facilitate easy override of the field to store the log sender's IP.

Alternate question: would it make sense to start shifting field names used by default and in the documentation/examples to using ECS field schema? Example as per above, no longer use `host` but instead `host.ip`, and no longer `hostname` but `host.name` or `host.hostname`; recommend using `event.type`, etc.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 18, 2019, 7:34am UTC](https://discuss.elastic.co/t/support-for-source-ip-fieldname-in-all-network-input-plugins/161798/2 "2019-01-18T07:34:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.