Can Anyone tell each and every step of how to use geoIP with logstash and kibana?


(Pinki Mondal) #1

Hi All
I have GeoLite2-City.mmdb and logstash ver 5.4.0. I am trying to use the db but nothing is working out.
Can anyone please explain the steps needed to do the loading of IP address in Logstash and transformed it into longitude and latitude in ES index
How to do this ??? Please explain that would be great help

Thanks


(Mark Walkom) #2

https://www.elastic.co/blog/geoip-in-the-elastic-stack should help you out.

If you follow that and still have issues, please provide as much detail as you can :slight_smile:


(Pinki Mondal) #3

Thank you for such a quick reply :star_struck:. Let me work it out. Will let you know if case of any query :innocent:


(Pinki Mondal) #4

This link is not working :disappointed_relieved: @warkolm


(Mark Walkom) #5

Works fine for me?


(Pinki Mondal) #6

Thank You so much :slight_smile:


(Pinki Mondal) #7

Can you tell where to give Template via Logstash file?


(Mark Walkom) #8

https://www.elastic.co/guide/en/logstash/5.6/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template


(Pinki Mondal) #9

I want to apply mapping on a particular index. How to apply that??? because by default when data is inserted through Logstash, geoip.location is set a float but its type should be geo_point.


(Mark Walkom) #10

If you are using the default Logstash configuration then it will be mapped to a geopoint.
If it's not doing that, then providing your config would be a useful starting point to troubleshooting.


(Pinki Mondal) #11

This is my configuration file...
By this I am getting float type of geoip.location. How can I give mapping in this file ?
input {
stdin {}
}

filter {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
geoip {
source => "clientip"
}
}

output {
stdout { codec => dots }
elasticsearch {
hosts => ["ipAddress:port"]
index => "my_index"
document_type => "my_type"
}
}


(Mark Walkom) #12

That's why, the default template won't match that index pattern.

Have a look at the Custom Index Names section of this https://www.elastic.co/blog/geoip-in-the-elastic-stack


(system) #13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.