Using LS 2.0, can't get split and/or geoip working - trying to split my xforwardfor field and pass into geoip

Elastic Stack Logstash
1

My LS filter config line:

split {
field => "xforwardfor"
terminator => ","
}

but in kibana, I still see the field as one string

"referer": "http://www.mysite.com/",
"xforwardfor": "1.2.3.4, 5.6.7.8",
"hostname": "myhostname",

I tried deleting all of the indices using curator just in case there was a mapping conflict, but it didn't seem to help.

I didn't see an errors in logstash or elasticsearch logs

I'm also trying to pass this into geoip, but first things first - to split the string...

my geoip filter config:

geoip {
source => "xforwardfor"
target => "geoip"
database => "/opt/logstash/vendor/geoip/GeoLiteCity.dat"
}

geoip and geoip.location are of type geo_point but don't get populated with anything.

I'm using the latest ELK stack as of Nov 20, 2015 (ES 2.0.0, LS 2.0.0-1, KIBANA 4.2.1)

2

Even xforwardfor headers with only a single IP aren't getting geoip location strings. Screengrab:

Pasted image933×593 44.6 KB

3

You know what, nevermind. You can close this issue.

I was using fluentd to pipe logs into ELK, but I figured out that fluentd just ships logs directly into elasticsearch and bypasses logstash altogether. This is why things in my logstash config made no difference. Sorry for the bandwidth.