GeoIP Field Selection

Elastic Stack Logstash
1

Trying to figure out the syntax of the Geoip filter field option. It says it accepts an array but I don't understand how you format a group of unrelated strings inside of an array....at least going by the example linked to in the documentation.

I've tried {"field1", "field2"} and {field1,field2} but I keep getting an error in the logs saying it expects either a # or => after the first option. Below is the error and my config, line 29 is the fields line:

Failed to execute action {:id=>:CloudFlare, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Expected one of #, => at line 29, column 25

  geoip {
    source => "ClientIP"
    fields => {city_name,country_code2,country_name,latitude,longitude,timezone}
  }
}
2

An array looks like this: ["item1", "item", ..., "itemN"]

3

bah....I was misreading the array example in documentation.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.