Cache optimization for ip2location filter problem


(Deyan Denchev) #1

Hello, I have implemented cache optimization for ip2location filter ( which is similar to the default geoip filter). When event (a line of log file) is send for the first time everything is ok ( the ip2location fields are shown in Logstash output and kibana) but when the same event is send for the second time ip2location fields disappeared. The strangest thing is that when I am debugging it at the end of the "filter_matched(event)" logstash method the ip2location fields are there but when the information is passed to logstash output , it suddenly dissappears.
Do you have any idea where can be the problem? Do you know which method is called after filter_matched(event) method in order to pass the json (with the parsed information) to logstash output or elasticsearch? Thank you


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.