Pull IP address

Graylog Central (peer support)
1

Hello folks,

I’m using Graylog 4.0.5+d95b909, I’m trying to build monitoring system via slack, I managed to display full message, source hostname and also I need IP address, where I need your experience. I tried various variable with no luck. As per checking there is no IP address in message but when I search IP address in graylog it shows logs and also hostname of device.

Any suggestion where I should find IP address to insert variable in alert?

At this moment it looks like this :

[Event Definition]
Title: ${event_definition_title}
Device source : ${foreach backlog message}${message.source}${end}
Source IP : ${foreach backlog message}${message.ip}${end}
Full message : ${foreach backlog message}${message.message}${end}

image

2

Hi @shotarry
if there is no IP address in message from where do you want to extract it? Do you want to use IP address of sending device?

If so, you can use graylog’s internal field gl2_remote_ip which contains source IP address of sending device, so IP address of the sending server.

Source IP : ${foreach backlog message}${message.fields.gl2_remote_ip}${end}

1 Like
3

yes, that’s what i needed,

Thanks a lot, you are truly hero

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.