# How to show Hostnames instead of IP addresses

**URL:** <https://community.graylog.org/t/how-to-show-hostnames-instead-of-ip-addresses/31333>\
**Category:** Graylog Central (peer support)\
**Created:** [January 26, 2024, 11:05am UTC](https://community.graylog.org/t/how-to-show-hostnames-instead-of-ip-addresses/31333 "2024-01-26T11:05:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![zurattos](https://avatars.discourse-cdn.com/v4/letter/z/9de0a6/32.png) [@zurattos](https://community.graylog.org/u/zurattos)\
**Post date:** [January 26, 2024, 11:05am UTC](https://community.graylog.org/t/how-to-show-hostnames-instead-of-ip-addresses/31333/1 "2024-01-26T11:05:15Z")

</div>

Hello,

I want ask how to show Hostnames on Graylog instead of IP addresses , I’m using the latest version of Graylog on ubuntu 22.04

Best Regards,

---

<div class="post-metadata">

**Author:** ![valhaim](https://avatars.discourse-cdn.com/v4/letter/v/67e7ee/32.png) [@valhaim](https://community.graylog.org/u/valhaim)\
**Post date:** [January 29, 2024, 1:41pm UTC](https://community.graylog.org/t/how-to-show-hostnames-instead-of-ip-addresses/31333/2 "2024-01-29T13:41:24Z")

</div>

Hello,

where do you want to see hostnames instead of IP addresses? In your query? In your alert notification?

Which field are you using? Like `source` in your search query.  
Which logging format is being used (e.g. syslog / winlogbeat)?

---

<div class="post-metadata">

**Author:** ![zurattos](https://avatars.discourse-cdn.com/v4/letter/z/9de0a6/32.png) [@zurattos](https://community.graylog.org/u/zurattos)\
**Post date:** [January 29, 2024, 1:57pm UTC](https://community.graylog.org/t/how-to-show-hostnames-instead-of-ip-addresses/31333/3 "2024-01-29T13:57:42Z")

</div>

Hello,

I want to see it in dashboard/sources

I want to see it from Cisco devices which I have including some Linux machines ?

Is it possible as well to see in alerts ?

Best Regards

---

<div class="post-metadata">

**Author:** ![drewmiranda-gl](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/drewmiranda-gl/32/13376_2.png) [@drewmiranda-gl](https://community.graylog.org/u/drewmiranda-gl)\
**Post date:** [January 29, 2024, 5:07pm UTC](https://community.graylog.org/t/how-to-show-hostnames-instead-of-ip-addresses/31333/4 "2024-01-29T17:07:27Z")

</div>

You can use Graylog’s [DNS Lookup Adapter](https://go2docs.graylog.org/5-0/making_sense_of_your_log_data/lookup_tables.html#BuiltinDataAdapters) via a Pipeline rule to perform a reverse dns lookup and add the hostname.

Here is a sample pipleline rule. You will need to customize the ip field and the lookup table name to suit your needs.

```auto
rule "PARSE IP to DNS"
when
    has_field("source_ip")
    && regex(
        pattern: "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",
        value: to_string($message.source_ip)
        ).matches == true
then
    let rs = lookup_value("dns_lookups", to_string($message.source_ip));
    set_field("source_ip_dns", to_string(rs));
end

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 12, 2024, 5:08pm UTC](https://community.graylog.org/t/how-to-show-hostnames-instead-of-ip-addresses/31333/5 "2024-02-12T17:08:15Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.