Skip to content

Instantly share code, notes, and snippets.

@JonathanTron
Created September 5, 2013 12:05
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save JonathanTron/6449251 to your computer and use it in GitHub Desktop.
Save JonathanTron/6449251 to your computer and use it in GitHub Desktop.
Logstash 1.2.0 geoip debug
input { stdin { } }
filter {
json {
source => "message"
}
geoip {
source => '[usracct][device]'
add_field => [ "lonlat", "[%{[geoip][longitude]},%{[geoip][latitude]}]" ]
target => "geoip"
}
}
output { stdout { debug => true } }
# Start LS 1.2.0
jar -jar logstash-1.2.0-flatjar.jar agent -f geoip.conf
# Copy/Paste next line in the console and hit enter
{"usracct": {"device": "173.194.45.72"}}
# Output
{
"message" => "{\"usracct\": {\"device\": \"173.194.45.72\"}}",
"@timestamp" => "2013-09-05T11:59:22.796Z",
"@version" => "1",
"host" => "MacPro.local",
"usracct" => {
"device" => "173.194.45.72"
},
"geoip" => {
"ip" => "173.194.45.72",
"country_code2" => "US",
"country_code3" => "USA",
"country_name" => "United States",
"continent_code" => "NA",
"region_name" => "CA",
"city_name" => "Mountain View",
"postal_code" => "94043",
"latitude" => 37.41919999999999,
"longitude" => -122.0574,
"dma_code" => 807,
"area_code" => 650,
"timezone" => "America/Los_Angeles",
"real_region_name" => "California"
},
"lonlat" => "[-122.0574,37.41919999999999]"
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment