I configured my logstash to parse the logs.
I now want to configure geolocation. Is there a unique configuration for geolocation?
If so, I need help.
Here is my logstash setup below. How to complete with the geolocation configuration?
input {
tcp {
port => "5141"
codec => json
type => "syslog"
}
}
filter {
grok {
match => { "message" => "%{SYSLOG5424PRI:syslog_index}-\s*%{SYSLOGHOST:syslog_hostname} %{GREEDYDATA:syslog_message}" }
}
json {
source => "syslog_message"
}
mutate {
remove_field => [ "message", "syslog_message" ]
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["https://Elastic1:9200", "https://Elastic2:9200"]
user => "elastic"
password => "xxxxxxx"
cacert => "/etc/logstash/certs/ca.crt"
index => "jstest-%{+YYYY.MM.dd}"
action => "index"
}
}