Configure GeoIP in logstash to parse geographic information, logstashgeoip

Configure GeoIP in logstash to parse geographic information, logstashgeoip

The GeoIP database configured in logstash parses the ip address. Here, an open source ip data source is used to analyze the ip address of the client. The official website is here: MAXMIND

DownloadGeoLiteCityDatabase

Wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.tar.gztar-zxvf GeoLite2-City.tar.gzcp GeoLite2-City.mmdb/data/logstash/#/data/logstash is the installation directory of logstash

Modify the configuration file (custom config/logstash. conf)

Add filter

Geoip {source => "http_x_forwarded_for" # From the Client ip address in nginx target => "geoip" database => "/data/logstash/GeoLite2-City.mmdb" add_field => ["[geoip] [coordinates] ", "% {[geoip] [longpolling]}"] add_field => ["[geoip] [coordinates]", "% {[geoip] [latitude]}"]} mutate {convert => ["[geoip] [coordinates]", "float"]}

Effect displayed in kibana