Can we create two GeoIP Filters in one logstash config file?

Elastic Stack Logstash
13

I can suggest couple of things

  1. Not sure if ES 2.3 support "path": "full" for geoip anymore((remove "path": "full" )), so you just need to do something like following in your template

"dst_geoip" : {"type" : "object","dynamic": true,"properties" : {"location" : { "type" : "geo_point" }}},
"src_geoip" : {"type" : "object","dynamic": true,"properties" : {"location" : { "type" : "geo_point" }}}

  1. When I was using database in logstash 1.5.4 I used following, you need to check if it works for latest LS

geoip {
source => "src"
target => "geoip"
database => "E:\Geo_database\11-02-2016\GeoLiteCity.dat"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => [ "[geoip][coordinates]", "float"]
}

  1. Make sure you are using template_overwrite => "true" in LS

Let me know if it works also check this post Problems with geoip configuration