通过logstash

时间:2017-03-03 10:16:03

标签: elasticsearch logstash elastic-stack geoip maxmind

我想使用数据库GeoIP2-ISP.mmdb从带有logstash的IP地址获取Internet服务提供商。 GeoLite2-City.mmdb数据库正常工作,这是我的代码:

geoip {     
    source => "ip"
    database => "/home/ec2-user/logstash-5.2.0/GeoLite2-City.mmdb"
    target => "geoip"
    add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
    add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
    add_tag => "geoip"          
}       

mutate {        
    convert => [ "[geoip][coordinates]", "float"]       
}

我尝试使用相同的代码来获取ISP信息,但遗憾的是它失败了:

geoip {     
    source => "ip"
    database => "/home/ec2-user/logstash-5.2.0/GeoIP2-ISP.mmdb"
    target => "geoip"   
}

作为错误消息,我有:

enter image description here

请帮忙吗?谢谢 !

0 个答案:

没有答案