CODEWITHSUNDEEP
elasticsearchlogstashgeoipkibana
ataman79
ataman79

Reputation: 21

logstash - geoip in Kibana can not show any information using the IP addresses

I want to display the number of users accessing my app in a World Map using ElasticSearch, Kibana and Logstash.

Here is my log (Json format):

{
  "device": "",
  "public_ip": "70.90.17.210",
  "mac": "00:01:02:03:04:05",
  "ip": "192.16.1.10",
  "event": {
    "timestamp": "2014-08-15T00:00:00.000Z",
    "source": "system",
    "name": "status"
  },
  "status": {
    "channel": "channelname",
    "section": "pictures",
    "downlink": 1362930,
    "network": "Wi-Fi"
  }
}

And this is my config file:

input {
  file { 
    path => ["/mnt/logs/stb.events"]
    codec => "json" 
    type => "event" 
  }
}
filter {
    date    {
        match => [ "timestamp", "yyyy-MM-dd HH:mm:ss", "ISO8601" ]
    }
}

filter {
    mutate  {
        convert => [ "downlink", "integer" ]
    }
}
filter {
    geoip {
      add_tag => [ "geoip" ]
      database => "/opt/logstash/vendor/geoip/GeoLiteCity.dat" 
      source => "public_ip"
      target => "geoip"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
          }
    mutate {
      convert => [ "[geoip][coordinates]", "float" ]
    }
}
output { 
  elasticsearch {
    host => localhost
  }
}

At the end in Kibana I see only an empty geoip tag

Can someone help me and to point me where is my mistake?

Upvotes: 1

Views: 7440

Answers (1)

filipov
filipov

Reputation: 471

Since Logstash 1.3.0 you can use the geoip.location field that is created automatically instead of creating the coordinates field and converting it to float manually.

One curly bracket seems to be missing from your log, I guess this is the correct format:

{
    "device": {
        "public_ip": "70.90.17.210",
        "mac": "00:01:02:03:04:05",
        "ip": "192.16.1.10"
    },
    "event": {
        "timestamp": "2014-08-15T00:00:00.000Z",
        "source": "system",
        "name": "status"
    },
    "status": {
        "channel": "channelname",
        "section": "pictures",
        "downlink": 1362930,
        "network": "Wi-Fi"
    }
}

In this case I would suggest you to try the following configuration for the filter (without mutate):

filter {
    geoip {
        source => "[device][public_ip]"
    }
}

Then you should be able to use "geoip.location" in your map. I did quite some research and debugging to find out that in order to be resolved correctly, nested fields should be surrounded by [ ] when used as source.

Upvotes: 2

Related Questions