Question

我正在尝试使用apache访问日志中的geoip和logstash 2.4，elasticsearch 2.4，kibna 4.6。

我的logstash过滤器是......

input {
file {
path => "/var/log/httpd/access_log"
type => "apache"
start_position => "beginning"
}
}

filter {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
geoip {
source => "clientip"
target => "geoip"
database =>"/home/elk/logstash-2.4.0/GeoLiteCity.dat"
#add_field => { "foo_%{somefield}" => "Hello world, from %{host}" }
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => [ "[geoip][coordinates]", "float" ]
}
}

output {
stdout { codec => rubydebug }
elasticsearch
{ hosts => ["192.168.56.200:9200"]
sniffing => true
manage_template => false
index => "apache-geoip-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}

如果elasticsearch解析一些apache访问日志，则输出为......

    {
       "message" => "xxx.xxx.xxx.xxx [24/Oct/2016:14:46:30 +0900] HTTP/1.1 8197 /images/egovframework/com/cmm/er_logo.jpg 200",
      "@version" => "1",
    "@timestamp" => "2016-10-24T05:46:34.505Z",
          "path" => "/NCIALOG/JBOSS/SMBA/default-host/access_log.2016-10-24",
          "host" => "smba",
          "type" => "jboss_access_log",
      "clientip" => "xxx.xxxx.xxx.xxx",
         "geoip" => {
                      "ip" => "xxx.xxx.xxx.xxx",
           "country_code2" => "KR",
           "country_code3" => "KOR",
            "country_name" => "Korea, Republic of",
          "continent_code" => "AS",
             "region_name" => "11",
               "city_name" => "Seoul",
                "latitude" => xx.5985,
               "longitude" => xxx.97829999999999,
                "timezone" => "Asia/Seoul",
        "real_region_name" => "Seoul-t'ukpyolsi",
                "location" => [
            [0] xxx.97829999999999,
            [1] xx.5985
        ],
             "coordinates" => [
            [0] xxx.97829999999999,
            [1] xx.5985
        ]
    }
}

我无法看到geo_point字段。

请帮帮我。谢谢。

我在瓷砖地图中添加了我的错误。

它说“logstash- *索引模式不包含以下任何字段类型：geo_point”

Answer 1

嗯...... geoip字段已经在你的回复中了！

进入“geoip”字段，您可以找到所有需要的信息（ip，continent，country name，...）。添加的字段coordinates也存在。那么，问题是什么？

无法在logstash 2.4中使用geo_ip

1 个答案: