GeoIP with JSON

Elastic Stack Logstash
1

I'm having some difficulty pushing the correct field from my json to the GeoIP filter module. My goal is to add the GeoIP data to each event as it comes in. I've been trying to test this using the following config file. However every time I get [0]_geoip_lookup_failure
Please advise

My json looks like this: {"computer": {"ip": "8.8.8.8"}}

input {
stdin{
codec => "json"
}
}
filter{
geoip {
source => "%{[computer][ip]}"
target => "[GeoIP]"
}
}
}
output {
stdout {
codec => rubydebug
}
}

2

The source to the geoip filter says to substitute the value of the [computer][ip] field for the name of the source. That is not what you want.

geoip {
    source => "[computer][ip]"
    target => "[GeoIP]"
}
1 Like
3

I could swear I had tried that in the variations I tried. Evidently I danced around it. Thank you!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.