Hi, When i send nginx logs using logstash-forwarder i am getting following in response `172.10.6.182 - - [22/Feb/2016:02:06:53 -0500] "GET /analytics.js HTTP/1.1" 301 184 " http://www.hjhjhjkk.com/searchResult " "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.…

I'm a bit surprised that you're getting anything useful from a GeoIP lookup of 10.10.10.10 since the whole 10.0.0.0/8 network isn't routable on the Internet and no addresses in that range have a geolocation. I can only assume that the geoip filter doesn't get a match for, in this case, 10.101.3.3 an…

Those IP's are changed just to be sure that I am not exposing anything to Internet. Sorry..:slight_smile:

Thanks, It seems I have to do something like that so that internal network is also mapped.

Discuss the Elastic Stack

Geoip not working while taking input from lumberjack

Elastic Stack Logstash

warkolm (Mark Walkom) February 23, 2016, 12:05am 3

Check out Creating geoip data for internal networks for an option for geoip on internal networks.

Topic		Replies	Views
Getting geoip to work Logstash	5	1177	July 6, 2017
Geoip field is not showing in dashboard Logstash	13	2115	February 9, 2017
Geoip Field mapping Logstash	2	323	March 28, 2018
Logstash 7.1 and _geoip_lookup_failure Logstash	3	884	July 15, 2019
GeoIP - can't get it working Logstash	3	917	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Geoip not working while taking input from lumberjack

Related topics