I've seen a bunch of topics on how to map your private ip address to a geoip json object but I have a question on the fields and the structure. I'm following this thread Creating geoip data for internal networks but might switch over to this Create Custom geoip database for Logstash 5.2 as I have many private ip's I need to map
EDIT: link to second option: Private ip geoip from dictionary
Question 1 is about the location, do I need to have the nested [lat] and [lon] as in example #2 or is example #1 correct?
Question 2 is, do I need the [geo][ip] line? I have this already in [apache][access][remote_ip] and I wanted to know if this is required for the map in the dashboard
Question 3, I see the geo object in kibana but when I use the apache dashboard it does not plot the map. is there something else I need to do?
Question 4, where do I find the value for region_code?
Example: #1
{
"geoip": {
"timezone": "America/Detroit",
"continent_code": "US",
"country_name": "United States",
"region_code": "1111111111111",
"country_code2": "US",
"country_code3": "US",
"region_name": "Michigan",
"ip": "220.181.108.103",
"city_name": "Detroit",
"latitude": 42.5597,
"longitude": -83.1138,
"location": [42.5597, -83.1138]
}
}
Example #2
{
"geoip": {
"timezone": "America/Detroit",
"continent_code": "US",
"country_name": "United States",
"region_code": "1111111111111",
"country_code2": "US",
"country_code3": "US",
"region_name": "Michigan",
"ip": "220.181.108.103",
"city_name": "Detroit",
"latitude": 42.5597,
"longitude": -83.1138,
"location": {
"lon": -83.1138,
"lat": 42.5597
}
}
}
partial logstash config
if [apache2][access][remote_ip] =~ /^220.181.108.*/ {
mutate {
replace => {
"[geoip][timezone]" => "America/Detroit"
}
}
mutate {
replace => {
"[geoip][continent_code]" => "US"
}
}
mutate {
replace => {
"[geoip][country_name]" => "United States"
}
}
mutate {
replace => {
"[geoip][region_code]" => "MI"
}
}
mutate {
replace => {
"[geoip][country_code2]" => "US"
}
}
mutate {
replace => {
"[geoip][country_code3]" => "US"
}
}
mutate {
replace => {
"[geoip][region_name]" => "Michigan"
}
}
mutate {
remove_field => [ "[geoip][location]" ]
}
mutate {
add_field => {
"[geoip][location]" => "-83.1138"
}
}
mutate {
add_field => {
"[geoip][location]" => "42.5597"
}
}
mutate {
convert => [ "[geoip][location]","float" ]
}
mutate {
replace => [ "[geoip][latitude]","42.5597" ]
}
mutate {
convert => [ "[geoip][latitude]","float" ]
}
mutate {
replace => [ "[geoip][longitude]","-83.1138" ]
}
mutate {
convert => [ "[geoip][longitude]","float" ]
}
}