No geopoint for destination.ip but latitude and longitude field - 7.10

Elastic Stack Logstash
1

Hi,

i'm trying to use "geoip" module on a destination.ip.

My logstash code is :

    if [destination.ip] {
          geoip {
            source => "destination.ip"
            target => "destination.geo"
          }
    }

Geoip is working (almost fine), I have new fields in the Elastic output but no geopoint. I can see "destination.geo.location.lat" and "destination.geo.location.lon" as number field but no "destination.geo.location" whereas it is defined in my index template (see image)

template
template467×560 18.8 KB

Am I missing something ?

Thanks for help

2

try to add below section to logstash conf.d file.

filter {
geoip {
   source => "[destination][ip]"
   target => "[destination][geo]"}
geoip {
   source => "[source][ip]"
   target => "[source][geo]"
    }
}
~~~~~~~~~~~~~~~~
3

Thanks for your reply, I'm trying it and waiting for new alarms.

4

Hi,

Issue is solved, it was due to the source field type (ip instead of string as expected by geoip).

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.