Skip to content

Instantly share code, notes, and snippets.

@roycepope
Created June 20, 2016 05:26
Show Gist options
  • Save roycepope/9f73f73656a314a6bb47b823e4199496 to your computer and use it in GitHub Desktop.
Save roycepope/9f73f73656a314a6bb47b823e4199496 to your computer and use it in GitHub Desktop.
logstash/conf.d
filter {
if [type] == "apache" {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
geoip {
source => "clientip"
target => "geoip"
database => "/etc/logstash/GeoLiteCity.dat"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => [ "[geoip][coordinates]", "float"]
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment