'Elasticsearch: Alert on New IP Address

I've been stuck in a problem for 3 days now..I am trying to alert on new IP address but the format of log file is not helping me

so I've used a pipeline to parse the log with grok

%{NUMBER:bytes} %{IP:client} %{URIPATH:itstheip} %{GREEDYDATA:le-reste}

and then I've configured filebeat.yml :

output.elasticsearch:
  hosts: ["localhost:9200"]
  pipeline: my_pipeline_id`

but now I don't know what to do or where can I find the new parsed log file.

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Solution	Source