Hi, i parsed syslog_message to extract ip address from my ADSL modem to check who's ringing and store it into a new text field Varx (of my logstash index). Varx is a IPV4 text value computed every hours by an update_by_query POST in a cron job. The query looks into the syslog_message string to set…

FYI we’ve renamed ELK to the Elastic Stack, otherwise Beats and APM feel left out! :wink: Can you show us examples of the varx field?

Hi, Varx are string IPV4 WAN address as 'text' like xxx.xxx.xxx.xxx Mostly it's bot who perform port scanning. One value could be Varx = 222.186.129.68 (this one is in china :sunglasses:) As explained, once Varx has been computed (by the update_by_query running each hour) i would like to compute…

You will need to reprocess the document through the geoip filter, either in Logstash or an Ingest pipeline.

Thanks for your answer. Could you point out the way to do it accurately ? thanks

put this thread on top of stack:joy: Still not solve :factory::factory::factory::factory::factory:

https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html explains how to do this.

You can do this through the update by query API if you direct the data to update through an ingest node pipeline that uses the ingest geoip processor plugin (need to be installed separately).

Sorry, to bother but if the answer was easy in the doc we might not ask. From my perspective doc and info are really confusing not representative of the possibilities of the solution. Anyway, we will try to make it run. thanks i did a filter source => "Varx" and got a geoip failure parsing output …

Hi Thanks Christian, I read your answer again and installed the pipeline geoip. Perfect (need to increase heap space to avoid crash on the PI). Then it's complicated. I tried as in the doc this PUT _ingest/pipeline/geoip { "description" : "Add geoip info", "processors" : [ { "geoip" : { "f…

So you have stored the new pipeline. How did you use it to update documents?

Discuss the Elastic Stack

Kibana +geoip from ipv4 addr in a varx field

Elastic Stack Kibana

bruno-d (bruno.dev) December 14, 2017, 10:48am 6

hi guys, does someone can help on this product !

Topic		Replies	Views
Problems with geoip configuration Logstash	36	17989	July 6, 2017
Geoip Kibana	5	914	July 6, 2017
Geoip to geopoint Elastic Stack	3	973	November 4, 2022
Problemas con la configuracion geoip Elastic en Español	10	2682	July 6, 2017
Transforming logs into geo_point to draw them in kibana Elasticsearch	11	1182	March 28, 2023

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Kibana +geoip from ipv4 addr in a varx field

Related topics