Hi guys,
Using Elastic Stack : 6.4.0
I am currently reading in IIS logs and trying to get geoIP filtering to work with Kibana, however I am quite stuck at the moment.
When navigating to:
The following message is diplayed:
Could not locate that index-pattern-field (id: iis.access.geoip.location)
Moreover, the following errors are displayed when navigating to Dashboard:
I suspect that geoIP might be causing trouble. I have tried to follow the related topic:
But was unable to follow through, more specifically, how to access and specify/modify index templates in Windows.
We have the following inside our logstash pipeline.conf :
geoip {
"source" => "iis.access.remote_ip"
"target" => "iis.access.geoip.location"
}
Executing in DeV Tools console:
GET /_template/filebeat/
Results in following response (the response for /logstash/ is identical, except for the name of the first key):
{
"filebeat": {
"order": 0,
"index_patterns": [
"filebeat-*"
],
"settings": {
"index": {
"number_of_shards": "2",
"number_of_replicas": "1"
}
},
"mappings": {
"my_type": {
"dynamic": "true",
"properties": {
"geoip": {
"dynamic": true,
"properties": {
"location": {
"type": "geo_point"
}
}
}
}
}
},
"aliases": {}
}
}
the visState for Access Map [Filebeat IIS] Visualization Object:
{
"type": "tile_map",
"params": {
"mapCenter": [
0,
0
],
"mapZoom": 2,
"wms": {
"enabled": false,
"options": {
"transparent": true,
"format": "image/png"
}
},
"legendPosition": "bottomright",
"heatClusterSize": 1.5,
"mapType": "Scaled Circle Markers",
"isDesaturated": true,
"addTooltip": true
},
"aggs": [
{
"params": {},
"type": "count",
"enabled": true,
"id": "1",
"schema": "metric"
},
{
"params": {
"field": "iis.access.geoip.location",
"isFilteredByCollar": true,
"precision": 2,
"autoPrecision": true,
"useGeocentroid": true
},
"type": "geohash_grid",
"enabled": true,
"id": "2",
"schema": "segment"
}
],
"title": "Access map [Filebeat IIS]"
}
your help is highly appreciated.
Please let me know if you would like any additional information. Thanks in advance!