Hello, and sorry in advance if i didn't put the topic in the right subject.
My problem is that i can't get the geo_point to show in Kibana.
Here is my Logstash conf :
input {
beats {
# The port to listen on for filebeat connections.
port => 5044
# The IP address to listen for filebeat connections.
host => "0.0.0.0"
client_inactivity_timeout => 160
}
}
filter {
if [fileset][module] == "nginx" {
if [fileset][name] == "access" {
grok {
match => { "message" => ["%{IPORHOST:[nginx][access][remote_ip]} - %{DATA:[nginx][access][user_name]} \[%{HTTPDATE:[nginx][access][time]}\] \"%{WORD:[nginx][access][method]} %{DATA:[nginx][access][url]} HTTP/%{NUMBER:[nginx][access][http_version]}\" %{NUMBER:[nginx][access][response_code]} %{NUMBER:[nginx][access][body_sent][bytes]} \"%{DATA:[nginx][access][referrer]}\" \"%{DATA:[nginx][access][agent]}\""] }
remove_field => "message"
}
mutate {
add_field => { "read_timestamp" => "%{@timestamp}" }
}
date {
match => [ "[nginx][access][time]", "dd/MMM/YYYY:H:m:s Z" ]
remove_field => "[nginx][access][time]"
}
useragent {
source => "[nginx][access][agent]"
target => "[nginx][access][user_agent]"
remove_field => "[nginx][access][agent]"
}
geoip {
source => "[nginx][access][remote_ip]"
target => "[nginx][access][geoip]"
}
}
else if [fileset][name] == "error" {
grok {
match => { "message" => ["%{DATA:[nginx][error][time]} \[%{DATA:[nginx][error][level]}\] %{NUMBER:[nginx][error][pid]}#%{NUMBER:[nginx][error][tid]}: (\*%{NUMBER:[nginx][error][connection_id]} )?%{GREEDYDATA:[nginx][error][message]}"] }
remove_field => "message"
}
mutate {
rename => { "@timestamp" => "read_timestamp" }
}
date {
match => [ "[nginx][error][time]", "YYYY/MM/dd H:m:s" ]
remove_field => "[nginx][error][time]"
}
}
}
}
output {
elasticsearch {
hosts => "localhost"
index => "logstash-nginx-%{+YYYY.MM.dd}"
}
}
It seems like the mapping is done correctly at least the mapping of one of the indexes generated lets it believe :
"geoip": {
"dynamic": "true",
"properties": {
"ip": {
"type": "ip"
},
"latitude": {
"type": "half_float"
},
"location": {
"type": "geo_point"
},
"longitude": {
"type": "half_float"
}
}
}
And when i search for the said documents it appears that no error have occurred :
"geoip": {
"ip": "195.218.14.146",
"continent_code": "EU",
"country_code2": "LU",
"region_name": "Esch-sur-Alzette",
"country_name": "Luxembourg",
"location": {
"lat": 49.4958,
"lon": 5.9806
},
"city_name": "Esch-sur-Alzette",
"longitude": 5.9806,
"country_code3": "LU",
"timezone": "Europe/Luxembourg",
"latitude": 49.4958,
"region_code": "ES"
}
Yet when i try to visualize data nothing is showing, and i checked more than once if the requests were within the dates at the top right of the screen.
I'm completely lost ..
Thanks in advance
