Logstash with IP-API

(Ben B196) #1

Has anyone ever tried to integrate Logstash with http://ip-api.com. I know that Logstash has the GeoIP plugin which can be used. However, http://ip-api.com has a much cheaper and easier to maintain setup than having to update database files weekly.

I did not come across anyone talking about integrating the two through Google and was wondering if maybe someone has tried, but never wrote about it.

#2

Integration is trivial

   mutate { add_field => { "someIP" => "24.48.0.1" } }
   http { url => "http://ip-api.com/json/%{someIP}" target_body => "[geodata]" }