Ignore plugin error

Elastic Stack Logstash
1

I am using geoip plugin to geo code IP, but sometimes, event are coming with a wrong IP then geoip plugin throws error then nothing is output :confused:

https://github.com/logstash-plugins/logstash-filter-geoip/blob/master/lib/logstash/filters/geoip.rb#L160

Is it possible to silent error for specified plugins?

Thanks,

2

You could wrap the geoip filter in a conditional block and skip it unless the field looks like an IP address.

3

Yes, it was I finally done:

ruby
{
   init => "require 'resolv'"
   code => "event['valid_ip'] = !!(event['ip'] =~ Resolv::IPv4::Regex)"
}