Logstash 2.1.0 Geoip Filter

Elastic Stack Logstash
1

Hello together,

I would like to use the GeoIP filter for gettting the locations from the IP addresses. The code is working, but it does not parse the location field because it says: "reason"=>"field must be either [lat], [lon] or [geohash]"}}}}, :level=>:warn}
My conf file looks like this:
input { file { path => "/Users/oemer/locations.csv" start_position => "beginning" codec => plain { charset => "ISO-8859-1" } } } filter{ csv { columns => ["Dealer_Code","Location_ID","Answer_ID","IP_Address","OVERALL_SAT","RECOMMENDATION","",""] separator => "," } geoip { source =>"IP_Address" fields =>["longitude","latitude"] target =>"location" } } output { elasticsearch { hosts => "localhost:9200" } stdout{} }
The yellow error message looks like this for location:
"location"=>{"latitude"=>33.59559999999999, "longitude"=>-117.7003}}, "location"]}

Do you maybe know where the problem can be?

Thanks in advance.

2

If you get the error from Kibana, in the fields, you need to use "location" instead of "longitude" and "latitude". Below is my working config

	geoip {
		source => "IPV4_SRC_ADDR"
		target => "src_geoip"
		fields => ["country_code2", "country_name", "continent_code", "region_name", "real_region_name", "city_name", "postal_code", "timezone", "location"]
	}
1 Like