I'm struggling with getting IPV6 addresses to correctly show up in the GEO mapping. I've created the following configuration for Logstash:
input {
snmp {
walk => ["1.3.6.1.2.1.31.1.1.1"]
hosts => [{host => "udp:172.20.64.62/161" community => "public"}, {host => "udp:fda1:40:0:b:1c:6404:8061:7ccb/161" community => "Public"}, {host => "udp:fda1:40:0:b::8077:786/161" community => "Public"}]
}
}
filter {
mutate {
rename => ["host", "clientip"]
}
geoip {
source => "clientip"
database => "/home/kswaminathan/GeoLite2-City_20190402/GeoLite2-City.mmdb"
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "logstash"
}
}
I see the _geoip_lookup failure on the records that have a valid IPV6 address...I've even added a geo type to the template. I do not see any examples of IPV6 configuration related to GEO mapping. Any help would be greatly appreciated.
Thanks
Frank