Display Container IP Addresses

Display a table of Docker container IP addresses and container names

This is a query example for the Container ip addresses widget in the Docker Overview dashboard of the docker/metrics package.

Query

flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1{{Aggregate}} 2[/Drop Field\] 3[\Update Field Data\] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 2 fill:#2ac76d; style 3 fill:#ffbf00; click 2 #examples-docker-metrics-2bb40e27-d9cb-4cd9-8e46-83dd6267ab63-2

logscale

groupby(["container.name","docker.container.ip_addresses[0]"],function=count(docker.container.ip_addresses[0],distinct=true))
| drop(_count)
| rename("container.name",as="container name")
| rename("docker.container.ip_addresses[0]",as="container ip address")

Introduction

This widget is used to display a table of Docker container names alongside their associated IP addresses. By grouping events on both the container.name and docker.container.ip_addresses[0] fields and counting only distinct IP address values, the widget produces a deduplicated reference table that maps each container to its primary IP address. This makes it straightforward to identify which IP address is assigned to each running container within the selected time range.

In this widget, the groupBy() function is used to aggregate events by both container.name and docker.container.ip_addresses[0], applying a count() with distinct set to true on the docker.container.ip_addresses[0] field to ensure only unique IP address values are counted per container. The resulting _count field is then removed as it is not needed for display purposes, and both grouping fields are renamed to more human-readable labels for presentation in the table.

Example incoming data might look like this:

@timestamp	#repo	#type	@id	@ingesttimestamp	@rawstring	@timezone	@type	_datagen_identifier	agent.type	agent.version	container.id	container.image.name	container.name	docker.container.event.action	docker.container.event.actor.id	docker.container.event.from	docker.container.event.status	docker.container.event.type	docker.diskio.read.bytes	docker.diskio.read.ops	docker.diskio.summary.bytes	docker.diskio.summary.ops	docker.diskio.write.bytes	docker.diskio.write.ops	docker.event.action	docker.healthcheck.event.end_date	docker.healthcheck.event.exit_code	docker.healthcheck.failingstreak	docker.healthcheck.status	docker.image.created	docker.image.id.current	docker.image.id.parent	docker.image.size.regular	docker.image.size.virtual	docker.image.tags[0]	docker.info.containers.paused	docker.info.containers.running	docker.info.containers.stopped	docker.info.containers.total	docker.info.id	docker.info.images	event.dataset	event.module	host.name	metricset.name	service.type
2026-03-10T06:41:21	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_11_1773124881	2026-03-10T06:41:21	{"docker.image.id.current":"sha256:abcd1234efgh5678","metricset.name":"image","docker.image.size.regular":"133169152","docker.image.created":"2026-03-10T06:41:21.002Z","event.module":"docker","docker.image.tags":["nginx:latest"],"@timestamp":"2026-03-10T06:41:21.002Z","host.name":"docker-host-01","agent.type":"metricbeat","@type":"docker","event.dataset":"docker.image","agent.version":"7.11.1","docker.image.size.virtual":"133169152","docker.image.id.parent":"sha256:parent1234567890ab","service.type":"docker","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.11.1																				2026-03-10T06:41:21.002Z	sha256:abcd1234efgh5678	sha256:parent1234567890ab	133169152	133169152	nginx:latest							docker.image	docker	docker-host-01	image	docker
2026-03-10T06:41:21	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_12_1773124881	2026-03-10T06:41:22	{"@timestamp":"2026-03-10T06:41:21.801Z","event.module":"docker","host.name":"docker-host-02","container.image.name":"nginx:latest","agent.type":"metricbeat","metricset.name":"event","docker.event.action":"stop","docker.container.event.action":"start","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","service.type":"docker","docker.container.event.type":"container","docker.container.event.from":"redis:6.2-alpine","container.id":"a1b2c3d4e5f6","container.name":"nginx-web","event.dataset":"docker.event","docker.container.event.status":"Up 2 hours","@type":"docker","agent.version":"7.12.0","docker.container.event.actor.id":"b2c3d4e5f6a7"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.12.0	a1b2c3d4e5f6	nginx:latest	nginx-web	start	b2c3d4e5f6a7	redis:6.2-alpine	Up 2 hours	container							stop																	docker.event	docker	docker-host-02	event	docker
2026-03-10T06:41:22	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_13_1773124882	2026-03-10T06:41:23	{"docker.info.containers.paused":"0","docker.info.images":"15","metricset.name":"info","docker.info.containers.running":"5","agent.type":"metricbeat","host.name":"docker-host-03","event.module":"docker","@timestamp":"2026-03-10T06:41:22.581Z","agent.version":"7.13.2","@type":"docker","event.dataset":"docker.info","docker.info.containers.stopped":"2","docker.info.containers.total":"7","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","service.type":"docker","docker.info.id":"ABCD:EFGH:IJKL:MNOP:QRST:UVWX:YZ12:3456"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.13.2																										0	5	2	7	ABCD:EFGH:IJKL:MNOP:QRST:UVWX:YZ12:3456	15	docker.info	docker	docker-host-03	info	docker
2026-03-10T06:41:23	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_14_1773124883	2026-03-10T06:41:24	{"container.id":"c3d4e5f6a7b8","container.name":"redis-cache","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","service.type":"docker","docker.healthcheck.failingstreak":"0","@type":"docker","event.dataset":"docker.healthcheck","agent.version":"7.14.0","agent.type":"metricbeat","container.image.name":"postgres:14","event.module":"docker","@timestamp":"2026-03-10T06:41:23.389Z","host.name":"swarm-manager-01","docker.healthcheck.status":"healthy","docker.healthcheck.event.end_date":"2026-03-10T06:41:23.389Z","metricset.name":"healthcheck","docker.healthcheck.event.exit_code":"0"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.14.0	c3d4e5f6a7b8	postgres:14	redis-cache													2026-03-10T06:41:23.389Z	0	0	healthy													docker.healthcheck	docker	swarm-manager-01	healthcheck	docker
2026-03-10T06:41:24	auto-dashboard-queries	json	gtksp2dMmrYg9WSX5CeYyU5V_2_15_1773124884	2026-03-10T06:41:24	{"container.id":"d4e5f6a7b8c9","container.name":"postgres-db","service.type":"docker","_datagen_identifier":"bbe9c9c08ebf329bc648a36a3991a240","docker.diskio.read.ops":"125","docker.diskio.read.bytes":"1048576","docker.diskio.summary.bytes":"3145728","@type":"docker","event.dataset":"docker.diskio","docker.diskio.write.bytes":"2097152","agent.version":"7.15.1","docker.diskio.write.ops":"234","agent.type":"metricbeat","container.image.name":"mongo:5.0","event.module":"docker","@timestamp":"2026-03-10T06:41:24.187Z","host.name":"swarm-worker-01","docker.diskio.summary.ops":"359","metricset.name":"diskio"}	Z	docker	bbe9c9c08ebf329bc648a36a3991a240	metricbeat	7.15.1	d4e5f6a7b8c9	mongo:5.0	postgres-db						1048576	125	3145728	359	2097152	234																		docker.diskio	docker	swarm-worker-01	diskio	docker

Step-by-Step

Starting with the source repository events.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1{{Aggregate}} 2[/Drop Field\] 3[\Update Field Data\] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 2 fill:#2ac76d; style 3 fill:#ffbf00; click 2 #examples-docker-metrics-2bb40e27-d9cb-4cd9-8e46-83dd6267ab63-2 style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
groupby(["container.name","docker.container.ip_addresses[0]"],function=count(docker.container.ip_addresses[0],distinct=true))
```
Groups all events by the combination of container.name and docker.container.ip_addresses[0], producing one output row per unique pairing of container name and primary IP address.
The function parameter specifies a count() aggregation on docker.container.ip_addresses[0] with distinct set to true, which ensures that only unique IP address values are counted per group, avoiding duplication where the same IP address appears across multiple events for the same container. The count result is returned in the automatically created field _count.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1{{Aggregate}} 2[/Drop Field\] 3[\Update Field Data\] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 2 fill:#2ac76d; style 3 fill:#ffbf00; click 2 #examples-docker-metrics-2bb40e27-d9cb-4cd9-8e46-83dd6267ab63-2 style 2 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| drop(_count)
```
Removes the _count field from the result. Since the purpose of the widget is to display a reference table of container names and IP addresses rather than event counts, the count field produced by groupBy() is not needed and is discarded to keep the output clean.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1{{Aggregate}} 2[/Drop Field\] 3[\Update Field Data\] result{{Result Set}} repo --> 1 1 --> 2 2 --> 3 3 --> result style 2 fill:#2ac76d; style 3 fill:#ffbf00; click 2 #examples-docker-metrics-2bb40e27-d9cb-4cd9-8e46-83dd6267ab63-2 style 3 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
| rename("container.name",as="container name")
| rename("docker.container.ip_addresses[0]",as="container ip address")
```
Renames the technical field names to more human-readable labels for display in the table.
Event Result set.

Summary and Results

The widget is used to produce a deduplicated reference table that maps each Docker container name to its primary IP address, by grouping events on both fields and counting only distinct IP address values before presenting the results with human-readable column names.

This widget is useful to operations and platform teams who need a quick reference of which IP address is assigned to each running container, supporting network troubleshooting, access control reviews, and container inventory management within the selected time range.

Sample output from the incoming example data:

container name
postgres-db
prometheus-monitor
rabbitmq-queue
redis-cache
worker-01

The output shows one row per unique container name observed in the data. The container ip address column is present in the actual widget output but is not populated in the sample result data shown here, as the incoming example events do not carry a docker.container.ip_addresses[0] field value.

Versions of this Page

Examples Library