Basic logstash grok pattern - need help

[Blason (R)]

Hi Guys,

I have file this and I am trying to build a pattern for the same. Somehow this is not working. Can some one please help

/var/log/badhost.txt =
125.118.243.164
216.245.208.133
199.59.242.150
104.145.232.3
.
.
.
.
.

input {
# add necessary input parameters
file {
type => "threat-intel"
path => "/var/log/badhost.txt"
}
}

filter {
if [type] == "threat-intel" {
grok {
match => { "message =>"%{ clientip:IPV4}"
"geoip": {
"field": "clientip"
}
}

[bad-smruti (Smruti Ranjan Swain)]

The basic syntax for GROK Pattern is %{SYNTAX:SEMANTIC}. So you need to change %{ clientip:IPV4} this :

@Blason

match => { "message =>"%{ clientip:IPV4}"

to

%{IPV4:clientip}

Refer this for the basic grok filter : Grok filter plugin | Logstash Reference [8.11] | Elastic

.

[Blason (R)]

Thanks I am complete novice to Logstash and learning bit by bit ..Thnks for the info though

[Blason (R)]

`input {

beats {
port => 5044
}
}

filter {
if [type] == "threat-intel" {
grok {
match => { "message" => "%{IPV4:clientip}"

    geoip {
            {
                    source => "clientip"
                    }
              }
            }
    }

}
output {
elasticsearch {
hosts => "192.168.1.15:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
`

Any clue with this config I am not able to parse geo tagging and I am accepting data over filebeat.

[magnusbaeck (Magnus Bäck)]

You've put your geoip filter inside your grok filter, i.e. your curly braces are mismatched.

[Blason (R)]

Hey there,

Is there any sample config that I can refer to? I mean these are just a simple IP addresses with Line break.

[magnusbaeck (Magnus Bäck)]

Well, in this case you don't need a grok filter since the lines as you say only contain the IP address. Just point the geoip filter at the message field, or use a mutate filter to rename message to clientip or whatever you prefer.

[Blason (R)]

so in my case it would just be match => Message?

[magnusbaeck (Magnus Bäck)]

No, drop the grok filter completely.

[Blason (R)]

If you dont mind would you please give me sample snippet? Plss? My use case is simple just have IP addresses and need to parse and tag with Geo_points

[magnusbaeck (Magnus Bäck)]

geoip {
  source => "message"
}

[Blason (R)]

Thanks man.. I really appreciate that