Private networks with GeoIP

[marcelo]

@marcelo

if [clientip] =~ /^192.168.254.*/ { mutate { replace => { "[geoip][timezone]" => "America/Recife" } } mutate { replace => { "[geoip][continent_code]" => "SA" } } mutate { replace => { "[geoip][country_name]" => "Brazil" } } mutate { replace => { "[geoip][region_code]" => "PE" } } mutate { replace => { "[geoip][country_code2]" => "BR" } } mutate { replace => { "[geoip][country_code3]" => "BR" } } mutate { replace => { "[geoip][region_name]" => "RECIFE" } } mutate { remove_field => [ "[geoip][location]" ] } mutate { add_field => { "[geoip][location]" => "-34,88" } } mutate { add_field => { "[geoip][location]" => "-8,05" } } mutate { convert => [ "[geoip][location]","float" ] } mutate { replace => [ "[geoip][latitude]","-8,05" ] } mutate { convert => [ "[geoip][latitude]","float" ] } mutate { replace => [ "[geoip][longitude]","-34,88" ] } mutate { convert => [ "[geoip][longitude]","float" ] } }

i've read the topic could-not-index-event and in stackoverflow topic -> logstash-geoip-location-mapping-to-geo-point-not-working and understood my problem.

My index was populated with location field, when i changed my index the location field become populated with my data.

thanks.