Logstash influxdb output with geoip feature

Elastic Stack Logstash
8

I'm sharing output of my "final" .conf file with geoip in filter part in case someone would find it useful :slight_smile:

  geoip {
    source => "clientip"
    add_field => {"longitude" => "%{[geoip][longitude]}"
                  "latitude"  => "%{[geoip][latitude]}"
                  "timezone"  => "%{[geoip][timezone]}"
                  "ip"  => "%{[geoip][ip]}"
                  "continent_code"  => "%{[geoip][continent_code]}"
                  "region_name"  => "%{[geoip][region_name]}"
                  "postal_code"  => "%{[geoip][postal_code]}"
                  "country_name"  => "%{[geoip][country_name]}"
                  "region_code"  => "%{[geoip][region_code]}"
                  "country_code3"  => "%{[geoip][country_code3]}"
    }
  }


}

output {
  stdout {codec => rubydebug}
  influxdb {
    host => "localhost"
    port => 8086
    db => "metrics"
    measurement => "test"
    codec => "json"
    use_event_fields_for_data_points => true
    send_as_tags => ["response", "host", "domain3", "domain2", "domain1", "referrer", "port", "protocol"]
    exclude_fields => ["@timestamp","timestamp","timestamp_object","timestamp_local","message","@version","geoip"]
  }
}
1 Like