Show custom geoip fields

Elastic Stack Logstash
1

I have add custom fields AcmeCorp.DeptName and AcmeCorp.DeptName whith maxmind_mmdb, but I can't find it in the last result with logstash geoip plugins, so I'm asking some help ~
Thanks you~

image

2

Based on the error message:

illegal field value AcmeCorp.DeptName. valid values are [AUTONOMOUS_SYSTEM_NUMBER, AUTONOMOUS_SYSTEM_ORGANIZATION, CITY_NAME, COUNTRY_NAME, CONTINENT_CODE, CONTINENT_NAME, COUNTRY_CODE2, COUNTRY_CODE3, DOMAIN, IP, ISP, POSTAL_CODE, DMA_CODE, REGION_NAME, REGION_CODE, TIMEZONE, LOCATION, LATITUDE, LONGITUDE, ORGANIZATION]

you are limited to only those fields so you would have to see about reusing one of those fields if that is supported in the blogpost for the mmdb file (ex: organization?).

3

Can I open the limit ?? I want to show many fields.
I don't see any way to replace these fields. 555..

4

I meant that those are the default and only fields that Logstash will return or accept as fields to return as they are 'hard-coded' into the geoip filter from what it looks like.

5

emm.. I see , and thank you~

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.