logstash geoip不适用于IPv4

Question

我使用logstash [版本2.2]将syslogs索引到elasticsearch中，我也使用geoip来获取源和目标地址，但在某些日志中，geoip似乎不起作用

**config file:** 

input {
        tcp {
                type => syslog
                port => 8001
        }
        udp {
                type => syslog
                port => 8001
        }


filter {
  if [type] == "syslog" {
     grok {
         match => {
            "message" => "\<%{NUMBER:number}\>%{timestamp:timestamp} %{WORD:logType}: %{NUMBER:ruleNumber},%{NUMBER:subRuleNumber}%{DATA}%{NUMBER:tracker},%{WORD:realinterface},%{WORD:reasonForTheLogEntry},%{WORD:actionTakenThatResultedInTheLogEntry},%{WORD:directionOfTheTraffic},%{NUMBER:IPversion},%{DATA:class},%{DATA:flowLabel},%{NUMBER:hopLimit},%{WORD:protocol},%{NUMBER:protocolID},%{NUMBER:length},%{IPV6:srcIP},%{IPV6:destIP},%{NUMBER:srcPort},%{NUMBER:destPort},%{NUMBER:dataLength}"

                }
       add_field => { "event" => "name" }
     }

  }
geoip {
   source => "srcIP"
   target => "geoSrc"
 }
geoip {
   source => "destIP"
   target => "geoDest"
 }
geoip {
   source => "icmpDetinationIP"
   target => "icmpDest"
 }

}
output {
    csv {
    fields => "message"
    path => "/data/streamed-logs/%{[host]}-%{+YYYY-MM-dd}.log"
    }
    stdout {
        codec => "rubydebug"
    }
    elasticsearch {
         hosts => "address"

  }
}

**address having problem with geoIP:**

我无法获取格式为e80 :: c0d3：531b的地址的geoIP：f0cf：f546

Answer 1

您需要使用IPV6 grok模式而不是IPV4

 grok {
     match => {
        "message" => "...%{IPV6:srcIP},%{IPV6:destIP},%{IPV6:icmpDetinationIP}..."
                              ^             ^              ^
                              |             |              |
                            here           here       and here
     }
 }