Filebeat + squid module GeoIP

Elastic Stack Beats
1

Hi there,

I´m trying to setup GeoIPs from internal, private IP addresses but no luck. Follow my filebeat.yml

processors:
- add_host_metadata:
       netinfo.enabled: true
       Geo:
         location: -23.499294, -46.824856
         continent_name: South America
         country_iso_code: BR
         region_name: Sao Paulo
         region_iso_code: BR-SP
         city_name: São Paulo
         name: Qintess
- add_fields:
       when.network.source.ip: [192.168.1.1/22] 
       fields:
         source.geo.location:
           lat: -23.499294
           lon: -46.824856
         source.geo.continent_name: South America
         source.geo.country_iso_code: BR
         source.geo.region_name: Sao Paulo
         source.geo.region_iso_code: BR-SP
         source.geo.city_name: São Paulo
         source.geo.name: Qintess
       target: ''
- add_fields:
       when.network.destination.ip: [192.168.1.1/22]       
       fields:
         destination.geo.location:
           lat: -23.499294
           lon: -46.824856
         destination.geo.continent_name: South America
         destination.geo.country_iso_code: BR
         destination.geo.region_name: Sao Paulo
         destination.geo.region_iso_code: BR-SP
         destination.geo.city_name: São Paulo
         destination.geo.name: Qintess
       target: ''

Can someone tell me if there´s any other settings I need to have?

Thanks in advance.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.