Can we create two GeoIP Filters in one logstash config file?

Elastic Stack Logstash
11

Hi Cody,

This is what you need to do . Assuming you are using ES1.7.X, because things are slight different if you are on ES2.X

step 1 --> In LS you need to update target for src_geoip and dst_geoip as geoip , something like (be sure src and dst fields should be IP type)

geoip { source => "src" target => "srcgeoip" }
geoip {source => "dst" target => "dstgeoip" }

Step 2) In ES template or using API you need to map fields to Geo_point

"srcgeoip" : {"type" : "object","dynamic": true,"path": "full","properties" : {"location" : { "type" : "geo_point" }}},
"dstgeoip" : {"type" : "object","dynamic": true,"path": "full","properties" : {"location" : { "type" : "geo_point" }}}

Step 3) now parse your data and you will see something like this in Kibana4.1.1

Let me know if you have more queries or concern on this

Thanks
VG