Logstash geoIP and dissect issues

[warkolm (Mark Walkom)]

As Magnus mentions, it would be better if you update the original thread with this extra info as it helps others understand the problem and what you've already worked through

Logstash Dissect Filter

I have Logstash Kibana and Elasticsearch versions 5.6.2 installed on Windows 2012 R2. I have a grok pattern that reads in text file entries adequately. The end of each entry is a message field containing a couple different formats; sometimes an IP adress, sometimes 2 IP addresses and different messages attached. What I need is to pull only the entries that have an outside IP address and I need to pull that IP address and put it in a field and use it as the source for geoIP. I was thinking of usi…