Kibana 4 and geoip

Elastic Stack Kibana
23

Here it is (albeit spread out over different files in conf.d)

input {
  beats {
    host => "10.0.3.1"
    port => 5044
  }
}
filter {
  if [type] == "nginx_access" {
    grok {
      patterns_dir => ["/home/csapp/.logstash/patterns"]
      match => { "message" => "%{NGINXACCESS}" }
    }
    date {
      match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
    }
    geoip {
      source => "clientip"
      database => "/home/csapp/.logstash/GeoLiteCity.dat"
    }
  }
}
output {
  if [type] == "nginx_access" and [response] =~ /^(5\d\d|^4\d\d)/ {
    elasticsearch {
      hosts => ["*****:9200"]
      index => "nginx_access-%{+YYYY.MM.dd}"
      user => "admin"
      password => "*******"
    }
  }
}