Hello,
I try to use geoip for my source adresse, but sometimes it shows the correct city name, sometimes it shows a wrong location and there is no geoip.city_name field. However if i look up the ip i the maxmind demo (https://www.maxmind.com/en/geoip2-precision-demo) it shows the right location. How can I solve the problem ? is it possible to put "other" in the field so that it's never empty ?
here is the relevant part of config :
1 filter {
2 if [syslog_program] =~ "filterlog" {
3 grok {
4 match => ["syslog_message", "(%{NONNEGINT:rule_number})?\,(%{NONNEGINT:sub_rule_number})?\,(%{DATA:anchor})?\,(%{NONNEGINT:tracker_id})?\,%{DATA:interface}\,%{DATA:reason}\,%{DATA:action}\,%{ DATA:direction}\,%{NONNEGINT:ip_version},%{GREEDYDATA:sub_msg}"]
5 }
6 if [ip_version] =~ "4" {
7 csv {
8 source => [sub_msg]
9 columns => ["ipv4_tos","ipv4_ecn","ipv4_ttl","ipv4_id","ipv4_offset", "ipv4_flags","ipv4_protocol_id","ipv4_protocol","ipv4_protocol_length","source_ip","destination_ip","source_port","destin ation_port","data_length","tcp_flags","sequence_number","ack","window","urg","options"]
10 separator => ","
11 }
12 }
13 if [ip_version] =~ "6" {
14 csv {
15 source => [sub_msg]
16 columns => ["class","flow_label","hop_limit","protocol","protocol_id","length","source_ip","destination_ip","source_port","destination_port","data_length","tcp_flags","sequence_number","ack", "window","urg","options"]
17 separator => ","
18 }
19 }
20 mutate {
21 convert => [ "destination_port", "integer" ]
22 convert => [ "source_port", "integer" ]
23 convert => [ "ip_version", "integer" ]
24 convert => [ "data_length", "integer" ]
25 convert => [ "ipv4_protocol_length", "integer" ]
26 convert => [ "ipv4_ttl", "integer" ]
27 convert => [ "rule_number", "integer" ]
28 replace => { "type" => "firewall" }
29 add_tag=> [ "pfsense" ]
30 remove_field => [ "sub_msg", "syslog_message" ]
31 }
32 geoip {
33 source => source_ip
34 fields => ["city_name", "location"]
35 database => "/etc/logstash/GeoLite2-City.mmdb"
36 tag_on_failure => ["geoip_failed"]
37 }
38 }
39 }