Logstash conf - geoIP not workin

Elastic Stack Logstash
1

Hello guys,

please could you help me to identify error in my logstash config? I would like to see in kibana special field for geoip.

My logstash config looks like this:

input {
beats {
port => 5044
host => "0.0.0.0"
}
}
filter {
grok {
match => { "message" => "%{IP:client} <%{IP:hostAddress}> - - [%{HTTPDATE:timestamp}] "%{WORD:method} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response} %{NUMBER:bytes}" }
geoip {
add_field => { "geoIP" => "%{client}" }
}
}
}
output {
elasticsearch {
hosts => localhost
}
}

Thank you

2

you need to define Geoip mapping template

and modify your geoip filter to

    geoip {
      source => "client"
    }
3

PLease how can I do this -> define Geoip mapping template ???

4

???? This is dead forum. How else can one get help regarding this if not here?

5

If you use source => "client" in your Geoip filter and index into the default index name I think the existing template should take care of that for you.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.