Multiple geoip target for source and destination

Elastic Stack Logstash
1

Hi,

I just create logstash filter and need multiple target of geoip, for source and destination.
The source already have from the filter but for destination target not create the source.geoip.location and destination.geoip.location, only source.geoip.lat and source.geoip.lon.

I have create the template like below:

"source" : {
              "properties" : {
                "bytes" : {
                  "type" : "integer"
                },
                "geoip" : {
                  "properties" : {
                    "city_name" : {
                      "type" : "text",
                      "fields" : {
                        "keyword" : {
                          "type" : "keyword",
                          "ignore_above" : 256
                        }
                      }
                    },
                    "continent_code" : {
                      "type" : "text",
                      "fields" : {
                        "keyword" : {
                          "type" : "keyword",
                          "ignore_above" : 256
                        }
                      }
                    },
                    "country_code2" : {
                      "type" : "text",
                      "fields" : {
                        "keyword" : {
                          "type" : "keyword",
                          "ignore_above" : 256
                        }
                      }
                    },
                    "country_code3" : {
                      "type" : "text",
                      "fields" : {
                        "keyword" : {
                          "type" : "keyword",
                          "ignore_above" : 256
                        }
                      }
                    },
                    "country_name" : {
                      "type" : "text",
                      "fields" : {
                        "keyword" : {
                          "type" : "keyword",
                          "ignore_above" : 256
                        }
                      }
                    },
                    "dma_code" : {
                      "type" : "long"
                    },
                    "ip" : {
                      "type" : "ip"
                    },
                    "latitude" : {
                      "type" : "half_float"
                    },
                    "location" : { 
                      "type" : "geo_point" 
                    }, 
                    "longitude" : {
                      "type" : "half_float"
                    },
                    "postal_code" : {
                      "type" : "text",
                      "fields" : {
                        "keyword" : {
                          "type" : "keyword",
                          "ignore_above" : 256
                        }
                      }
                    },
                    "region_code" : {
                      "type" : "text",
                      "fields" : {
                        "keyword" : {
                          "type" : "keyword",
                          "ignore_above" : 256
                        }
                      }
                    },
                    "region_name" : {
                      "type" : "text",
                      "fields" : {
                        "keyword" : {
                          "type" : "keyword",
                          "ignore_above" : 256
                        }
                      }
                    },
                    "timezone" : {
                      "type" : "text",
                      "fields" : {
                        "keyword" : {
                          "type" : "keyword",
                          "ignore_above" : 256
                        }
                      }
                    }
                  }
                }

Is my template wrong?

Appreciate of some help...

Regards,
Fadjar Tandabawana

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.