No geopoint for destination.ip but latitude and longitude field - 7.10

Hi,

i'm trying to use "geoip" module on a destination.ip.

My logstash code is :

    if [destination.ip] {
          geoip {
            source => "destination.ip"
            target => "destination.geo"
          }
    }

Geoip is working (almost fine), I have new fields in the Elastic output but no geopoint. I can see "destination.geo.location.lat" and "destination.geo.location.lon" as number field but no "destination.geo.location" whereas it is defined in my index template (see image)

Am I missing something ?

Thanks for help

try to add below section to logstash conf.d file.

filter {
geoip {
   source => "[destination][ip]"
   target => "[destination][geo]"}
geoip {
   source => "[source][ip]"
   target => "[source][geo]"
    }
}
~~~~~~~~~~~~~~~~

Thanks for your reply, I'm trying it and waiting for new alarms.

Hi,

Issue is solved, it was due to the source field type (ip instead of string as expected by geoip).

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.