Plotting geoIP Data in Kibana Maps via Beats Output to Logstash

Elastic Stack Logstash
1

We're running on Elastic Stack 7.5 and have all of our Beats output being sent to Logstash. Then from Logstash, output is sent to Elasticsearch and Kibana.

Using this flow, we have been unsuccessful in implementing geoIP data so that we can have Kibana plot source and destination IP addresses in its maps (in both "Map" and in SIEM/Network Map). However, when we change a Beats output to Elasticsearch (bypassing Logstash), maps are populating in SIEM/Network Map.

Our goal was to send all Beats output to Logstash and centrally-manage via Logstash. However, we are unable to populate maps via Logstash.

If we add a second Logstash output to the Beat for geoIP, geoIP data is not being populated in geoIP fields:
output.logstash:
hosts: ["host IP address:5044"]
pipeline: geoip-info

If we add a separate output in Beats to Elasticsearch (and retain the Logstash output config), dedicated-to processing/populating geoIP data, the Beats service fails to start:
output.elasticsearch:
hosts: ["host IP address:9200"]
pipeline: geoip-info

Any thoughts?

2

That results in the data from beats being sent through the geoip-info ingestion pipeline when it gets to elasticsearch.

To do that via logstash you need to set the pipeline option on the elasticsearch output in your logstash configuration.

3

Thank you for your reply. We tried the following config in Logstash and it appears forwarding to elasticsearch started failing although Logstash restarted fine (Sorry for the formatting):

Sample Logstash configuration for creating a simple

Beats -> Logstash -> Elasticsearch pipeline.

input {
beats {
host => "Some IP Address"
port => 5044
}
}

filter {

geoip {

source => "[destination][ip]"

}
}
output {
elasticsearch {
hosts => ["http://Some IP Address:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
pipeline: geoip-info
#user => "elastic"
#password => "changeme"
}
}

4

In logstash that should be

pipeline => "geoip-info"
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.