# Use host IP (or dns) in the output file path

**URL:** <https://discuss.elastic.co/t/use-host-ip-or-dns-in-the-output-file-path/370944>\
**Category:** Logstash\
**Created:** [November 22, 2024, 10:21am UTC](https://discuss.elastic.co/t/use-host-ip-or-dns-in-the-output-file-path/370944 "2024-11-22T10:21:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Po-temkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/po-temkin/32/138703_2.png) [@Po-temkin](https://discuss.elastic.co/u/Po-temkin)\
**Post date:** [November 22, 2024, 10:21am UTC](https://discuss.elastic.co/t/use-host-ip-or-dns-in-the-output-file-path/370944/1 "2024-11-22T10:21:36Z")

</div>

Hello to everyone!  
My question looks like obvious, but I missed something basic and stuck =)

I have a UDP input that I want to output as a file  
My desired output file path is:  
E:/logstash/log/$host\_ip$/$date$.log

It seems that pipeline conf must look ilke this:

```auto
output {
    file {
        path => "E:/logstash/log/$host_ip$/%{+YYYY-MM-dd-HH}.log"
    }
}

```

So, the question is how to reference a host ip?

This is an example of the event:

```auto
{"host":{"ip":"172.22.255.5"},"event":{"original":"<166>Nov 22 2024 13:06:46 0.0.0.0 : %ASA-6-305012: Teardown dynamic TCP translation from inside:172.29.90.17/45992 to outside:1.2.3.4/45992 duration 0:00:03\n"},"@timestamp":"2024-11-22T10:06:46.866042800Z","message":"<166>Nov 22 2024 13:06:46 0.0.0.0 : %ASA-6-305012: Teardown dynamic TCP translation from inside:172.29.90.17/45992 to outside:1.2.3.4/45992 duration 0:00:03\n","@version":"1"}

```

I tried to use different references in the output config but didn't find a solution  
Tried this:  
E:/logstash/log/%{host}/%{+YYYY-MM-dd-HH}.log  
E:/logstash/log/%{host.ip}/%{+YYYY-MM-dd-HH}.log  
E:/logstash/log/%[host][ip]/%{+YYYY-MM-dd-HH}.log

---

<div class="post-metadata">

**Author:** ![adilraad2001](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adilraad2001/32/138356_2.png) [@adilraad2001](https://discuss.elastic.co/u/adilraad2001)\
**Post date:** [November 22, 2024, 10:30am UTC](https://discuss.elastic.co/t/use-host-ip-or-dns-in-the-output-file-path/370944/2 "2024-11-22T10:30:01Z")

</div>

try:  
E:/logstash/log/%{[host][ip]}/%{+YYYY-MM-dd-HH}.log

---

<div class="post-metadata">

**Author:** ![Po-temkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/po-temkin/32/138703_2.png) [@Po-temkin](https://discuss.elastic.co/u/Po-temkin)\
**Post date:** [November 22, 2024, 11:21am UTC](https://discuss.elastic.co/t/use-host-ip-or-dns-in-the-output-file-path/370944/3 "2024-11-22T11:21:57Z")

</div>

It works! Thank you  
I was pretty near =)