Only invoke geoip if field is IP

Elastic Stack Logstash
1

How do I conditionally invoke geoip if the field is a valid IP address?

2

Use a conditional.

if [fieldname] =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/ {
  geoip {
    ...
  }
}

Not the best and most stringent expression for validating IPv4 addresses but you get the idea.

3

Thanks for your input. I realize grok has patterns for IP (IPv4 or IPv6) already. Can I do this:

grok {
    match => { "clientIP" => "%{IP:validIP}" }
}

geoip {
    source => "validIP"
    remove_field => "validIP"
}

Thanks

4

Yes, but you probably want to disable the _grokparsefailure tag (tag_on_failure parameter to grok IIRC). I'm assuming the geoip filter behaves nicely when the field named in source doesn't exist.