Good morning everyone, today I'm trying to implement the geoip filter, using this input file : filter { if [host] =~ /10\.0\.0\.1/ { grok { match => [ "message", "\A%{SYSLOG5424PRI}%{SYSLOGTIMESTAMP}( )%{WORD}(: )(?:[0-9])?,(?:[0-9]*,)?(?:[0-9]*,)?(?:[0…

That is indeed not correct. You can copy the default Logstash template, change the index pattern it matches and then upload it using a different name. You will need to reindex the data though.

Discuss the Elastic Stack

Geoip create everything but the geoip.location

Elastic Stack Logstash

Adesfire December 5, 2017, 7:23am 14

Thanks for this tip!

Topic		Replies	Views
No location field Geoip plugin Logstash	5	1153	August 25, 2017
GeoIP - locate ip address from text file Logstash	3	610	November 14, 2019
Logstash geoip Logstash	5	1559	October 19, 2017
Logstash Setup with GeoIP Logstash	18	2719	October 9, 2019
Adding GeoIP using logstash Logstash	3	1101	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Geoip create everything but the geoip.location

Related topics