Hi all,
I would like to ask for help. I am parsing data from our firewall and there are fields containing IP address. I would like to use Coordinates map to visualize accesses. Problem is that i am missing geo.location field in parsed data.
ELK 7.2.0
logstash config:
filter {
if "USG3P" in [tags] {
grok {
match => {
"[message]" => [
"%{TIMESTAMP_ISO8601:date} %{DATA:device} %{DATA:logsource}:\s+[%{DATA:rules.int}-%{DATA:rules.index}-%{DATA:rules.action}]IN=%{DATA:interfaces.input}\s+OUT=%{DATA:interfaces.output}\s+MAC=%{DATA:mac}\s+SRC=%{IPV4:SRC}\s+DST=%{IPV4:DST}\s+LEN=%{INT:LEN}\s+TOS=%{BASE16NUM:TOS}\s+PREC=%{BASE16NUM:PREC}\s+TTL=%{INT:TTL}\s+ID=%{INT:ID}\s+%{DATA:flags}\s+PROTO=%{WORD:PROTO}\s+SPT=%{INT:SPT}\s+DPT=%{INT:DPT}\s+WINDOW=%{INT:WINDOW}\s+RES=%{BASE16NUM:RES}\s+%{WORD:flag1}\s+%{WORD:flag2}\s+%{WORD:flag3}\s+URGP=%{WORD:URGP}%{GREEDYDATA:rest}",
"%{TIMESTAMP_ISO8601:date} %{DATA:device} %{DATA:logsource}:\s+[%{DATA:rules.int}-%{DATA:rules.index}-%{DATA:rules.action}]IN=%{DATA:interfaces.input}\s+OUT=%{DATA:interfaces.output}\s+MAC=%{DATA:mac}\s+SRC=%{IPV4:SRC}\s+DST=%{IPV4:DST}\s+LEN=%{INT:LEN}\s+TOS=%{BASE16NUM:TOS}\s+PREC=%{BASE16NUM:PREC}\s+TTL=%{INT:TTL}\s+ID=%{INT:ID}\s+%{DATA:flags}\s+PROTO=%{WORD:PROTO}\s+SPT=%{INT:SPT}\s+DPT=%{INT:DPT}\s+WINDOW=%{INT:WINDOW}\s+RES=%{BASE16NUM:RES}\s+%{WORD:flag1}\s+URGP=%{WORD:URGP}%{GREEDYDATA:rest}"
]
}
}
geoip {
source => "SRC"
}
}
}
here is index pattern:
detail of parsed fields: (missing geo.location)
Any suggestion?
Thank you Jan