Geo mapping issue

Elastic Stack Logstash
1

Hi All,

I have a issues in mapping the geo ip location to geo point.Could anyone please help me on this.Iam trying to analyse our cisco netflow data .When i tried to create tile map its resulting in no results found.

Pasted image979×421 13.8 KB

my logstash configuration is like this

filter {
if [type] == "netflow_cisco_asa" {

geoip {
source => "[netflow][ipv4_src_addr]"
target => "src_geoip"
database => "/opt/logstashGeo/GeoLiteCity.dat"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
geoip {
source => "[netflow][ipv4_dst_addr]"
target => "dst_geoip"
database => "/opt/logstashGeo/GeoLiteCity.dat"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => [ "[geoip][coordinates]", "float"]
}
}
}

This how my fields look like,

Pasted image1123×651 31 KB

Can any one please help me getting the tile map working for me ,it would be really helpful.

Thanks,
Raj

2

Are the events being added to an index that's included in your index pattern? Does your query match those events? Are you looking at the right time span?

3

Hi Magnus,

Thank you for the quick reply.Am new to ELK stack sorry am not sure whether am replying you correctly.Am able to see the fields which am trying to add in the index but I could see a check box in indexed and not in analysed ,when I see other elk videos for getting the tile map with geo coordinates it should be mapped with geo point.

But my index shows like this

Pasted image1025×103 4.28 KB

Thanks,
Raj

4

Am able to see the fields which am trying to add in the index but I could see a check box in indexed and not in analysed ,when I see other elk videos for getting the tile map with geo coordinates it should be mapped with geo point.

Sure, but until you've fixed the problem of not being able to locate your events this doesn't really matter. First things first.