# User\_agent and geoip filters does not work

**URL:** <https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219>\
**Category:** Logstash\
**Created:** [February 7, 2017, 12:09pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219 "2017-02-07T12:09:00Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![jonasv](https://avatars.discourse-cdn.com/v4/letter/j/22d042/32.png) [@jonasv](https://discuss.elastic.co/u/jonasv)\
**Post date:** [February 7, 2017, 12:09pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219/1 "2017-02-07T12:09:00Z")

</div>

Hey,

I'm got a field which looks like this:  
Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 OPR/42.0.2393.94  
or this:  
curl/7.47.0

filter {

```
mutate {
  remove_tag => ["beats_input_codec_plain_applied"]
}

```

if[type] == "nginx-access" {  
grok {  
patterns\_dir =\> ["/etc/logstash/patterns"]  
match =\> {"message" =\> "%{NGINXACCESS}"}  
}

```
useragent {
    source => "useragent"
    prefix => "browser"
}
geoip {
    source => "request_ip"
}

```

}

mutate {  
remove\_field =\> ["message", "fields", "beat.hostname", "[beat.name](http://beat.name)", "host"]  
gsub =\> ["request\_arrival\_time", "(.{6}$)", ""]  
}

}

Once I send new data - nothing changes in output, I see same fields and data just like if there were user\_agent and geoip filters. What I'm doing wrong here ?

thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 7, 2017, 12:11pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219/2 "2017-02-07T12:11:15Z")

</div>

Please show the result of a `stdout { codec => rubydebug }` output so we can see what the event really looks like.

---

<div class="post-metadata">

**Author:** ![jonasv](https://avatars.discourse-cdn.com/v4/letter/j/22d042/32.png) [@jonasv](https://discuss.elastic.co/u/jonasv)\
**Post date:** [February 7, 2017, 12:15pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219/3 "2017-02-07T12:15:25Z")

</div>

Magnus, could you please be more specific where to put that line ?

---

<div class="post-metadata">

**Author:** ![jonasv](https://avatars.discourse-cdn.com/v4/letter/j/22d042/32.png) [@jonasv](https://discuss.elastic.co/u/jonasv)\
**Post date:** [February 7, 2017, 12:16pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219/4 "2017-02-07T12:16:56Z")

</div>

I get PluginLoadingError: Couldn't find any filter plugin named 'stdout'.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 7, 2017, 12:19pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219/5 "2017-02-07T12:19:12Z")

</div>

> Magnus, could you please be more specific where to put that line ?

Anywhere inside an `output { }` block.

> I get PluginLoadingError: Couldn't find any filter plugin named 'stdout'.

I was sure that plugin was shipped with Logstash. But if it isn't, install it with the usual method.

---

<div class="post-metadata">

**Author:** ![jonasv](https://avatars.discourse-cdn.com/v4/letter/j/22d042/32.png) [@jonasv](https://discuss.elastic.co/u/jonasv)\
**Post date:** [February 7, 2017, 12:53pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219/6 "2017-02-07T12:53:34Z")

</div>

Thanks, I've put it into output block, restarted logstash, sent the data, but now what ? What should I see and most importantly - where ? Because I see no changes (not even in logstash/elk log files).

---

<div class="post-metadata">

**Author:** ![jonasv](https://avatars.discourse-cdn.com/v4/letter/j/22d042/32.png) [@jonasv](https://discuss.elastic.co/u/jonasv)\
**Post date:** [February 7, 2017, 1:10pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219/7 "2017-02-07T13:10:39Z")

</div>

This is my output.conf

output {  
stdout { codec =\> rubydebug }  
elasticsearch {  
hosts =\> ["10.1.2.129:9200"]  
sniffing =\> true  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 7, 2017, 1:13pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219/8 "2017-02-07T13:13:44Z")

</div>

You should start seeing events in /var/log/logstash/logstash.stdout or wherever stdout ends up for you. If you run Logstash interactively it's going to end up in your terminal.

---

<div class="post-metadata">

**Author:** ![jonasv](https://avatars.discourse-cdn.com/v4/letter/j/22d042/32.png) [@jonasv](https://discuss.elastic.co/u/jonasv)\
**Post date:** [February 7, 2017, 1:16pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219/9 "2017-02-07T13:16:11Z")

</div>

Thank you, you are right, here is the output you requested:

Sending logstash logs to /var/log/logstash/logstash.log.  
{  
"@version" =\> "1",  
"@timestamp" =\> "2017-02-07T13:05:16.579Z",  
"input\_type" =\> "log",  
"tags" =\> [  
[0] "project-X",  
[1] "web-server",  
[2] "beats\_input\_codec\_plain\_applied"  
],  
"count" =\> 1,  
"beat" =\> {  
"hostname" =\> "[deb.int.team.com](http://deb.int.team.com)",  
"name" =\> "deb"  
},  
"source" =\> "/var/log/nginx/elastic\_access.log",  
"offset" =\> 4672,  
"type" =\> "nginx-access",  
"request\_arrival\_time" =\> "07/Feb/2017:13:05:14",  
"request\_ip" =\> "10.1.2.129",  
"our\_server" =\> "[deb.int.team.com:8181](http://deb.int.team.com:8181)",  
"request" =\> "GET /test\_dev/151 HTTP/1.1",  
"request\_response\_code" =\> "404",  
"request\_body\_bytes\_sent" =\> "233",  
"user\_agent" =\> "curl/7.47.0",  
"referer" =\> "-",  
"request\_processing\_time" =\> "0.009",  
"upstream\_response\_time" =\> "0.009",  
"request\_length" =\> "108"  
}

---

<div class="post-metadata">

**Author:** ![jonasv](https://avatars.discourse-cdn.com/v4/letter/j/22d042/32.png) [@jonasv](https://discuss.elastic.co/u/jonasv)\
**Post date:** [February 7, 2017, 1:17pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219/10 "2017-02-07T13:17:19Z")

</div>

One more:

{  
"@version" =\> "1",  
"@timestamp" =\> "2017-02-07T13:16:21.649Z",  
"input\_type" =\> "log",  
"count" =\> 1,  
"source" =\> "/var/log/nginx/elastic\_access.log",  
"offset" =\> 4830,  
"type" =\> "nginx-access",  
"beat" =\> {  
"hostname" =\> "[deb.int.team.com](http://deb.int.team.com)",  
"name" =\> "deb"  
},  
"tags" =\> [  
[0] "project-X",  
[1] "web-server",  
[2] "beats\_input\_codec\_plain\_applied"  
],  
"request\_arrival\_time" =\> "07/Feb/2017:13:16:20",  
"request\_ip" =\> "10.100.2.2",  
"our\_server" =\> "[deb.int.team.com:8181](http://deb.int.team.com:8181)",  
"request" =\> "GET /test\_dev/160 HTTP/1.1",  
"request\_response\_code" =\> "404",  
"request\_body\_bytes\_sent" =\> "209",  
"user\_agent" =\> "Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 OPR/42.0.2393.94",  
"referer" =\> "-",  
"request\_processing\_time" =\> "0.006",  
"upstream\_response\_time" =\> "0.006",  
"request\_length" =\> "432"  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 7, 2017, 1:18pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219/11 "2017-02-07T13:18:51Z")

</div>

Your useragent filter doesn't work since it's trying to parse a field that doesn't exist (user\_agent vs. useragent).

Your geoip filter doesn't work because you can't geolocate RFC1918 addresses like 10.100.2.2.

---

<div class="post-metadata">

**Author:** ![jonasv](https://avatars.discourse-cdn.com/v4/letter/j/22d042/32.png) [@jonasv](https://discuss.elastic.co/u/jonasv)\
**Post date:** [February 7, 2017, 1:36pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219/12 "2017-02-07T13:36:20Z")

</div>

Thank you very much Magnus for helping me solving this!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 7, 2017, 1:36pm UTC](https://discuss.elastic.co/t/user-agent-and-geoip-filters-does-not-work/74219/13 "2017-03-07T13:36:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.