I've noticed that the field "country_code3" of geoip filter always returns the code with only 2 chars instead 3.
Configuration:
input { stdin { }
filter { geoip { source => "message" } }
output { stdout { codec => rubydebug } }
Log:
[INFO ] 2019-01-04 11:42:45.502 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"6.5.4"}
[INFO ] 2019-01-04 11:42:51.952 [[main]-pipeline-manager] geoip - Using geoip database {:path=>"/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-geoip-5.0.3-java/vendor/GeoLite2-City.mmdb"}
[INFO ] 2019-01-04 11:42:52.377 [Converge PipelineAction::Create] pipeline - Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x565ad322 run>"}
The stdin plugin is now waiting for input:
73.182.32.7
{
"@timestamp" => 2019-01-04T11:53:03.994Z,
"geoip" => {
"city_name" => "Savannah",
"region_code" => "GA",
"timezone" => "America/New_York",
"continent_code" => "NA",
"latitude" => 31.9951,
"region_name" => "Georgia",
"location" => {
"lat" => 31.9951,
"lon" => -81.2723
},
"postal_code" => "31419",
"country_name" => "United States",
"dma_code" => 507,
"country_code3" => "US",
"ip" => "73.182.32.7",
"longitude" => -81.2723,
"country_code2" => "US"
},
"host" => "host.domain",
"message" => "73.182.32.7",
"@version" => "1"
}
Thanks in advance.