Good morning everyone, today I'm trying to implement the geoip filter, using this input file : filter { if [host] =~ /10\.0\.0\.1/ { grok { match => [ "message", "\A%{SYSLOG5424PRI}%{SYSLOGTIMESTAMP}( )%{WORD}(: )(?:[0-9])?,(?:[0-9]*,)?(?:[0-9]*,)?(?:[0…

That is indeed not correct. You can copy the default Logstash template, change the index pattern it matches and then upload it using a different name. You will need to reindex the data though.

Geoip create everything but the geoip.location

Elastic Stack Logstash

Adesfire December 1, 2017, 11:06am 10

Ok that sounds good, but I'm unable to make a copy of the logstash template, I'm a newbie
I read many posts, but that seems to have changed (that never work)

Could you help me to do that operation, with the latest version of ELK ?

Topic		Replies	Views
No location field Geoip plugin Logstash	5	1153	August 25, 2017
GeoIP - locate ip address from text file Logstash	3	610	November 14, 2019
Logstash geoip Logstash	5	1559	October 19, 2017
Logstash Setup with GeoIP Logstash	18	2719	October 9, 2019
Adding GeoIP using logstash Logstash	3	1101	July 6, 2017

Geoip create everything but the geoip.location

Related topics