Hello, I have implemented cache optimization for ip2location filter ( which is similar to the default geoip filter). When event (a line of log file) is send for the first time everything is ok ( the ip2location fields are shown in Logstash output and kibana) but when the same event is send for the second time ip2location fields disappeared. The strangest thing is that when I am debugging it at the end of the "filter_matched(event)" logstash method the ip2location fields are there but when the information is passed to logstash output , it suddenly dissappears.
Do you have any idea where can be the problem? Do you know which method is called after filter_matched(event) method in order to pass the json (with the parsed information) to logstash output or elasticsearch? Thank you
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.