gistfile1.json

input {
  udp {
    port => 9995
    codec => netflow
  }
}
filter {
  geoip {
    source => "[netflow][ipv4_src_addr]"
    target => geoip
    database => "/usr/local/logstash/logstash-1.4.0/vendor/geoip/GeoLiteCity.dat"
    add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
    add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
  }
  geoip {
    source => "[netflow][ipv4_dst_addr]"
    target => geoip
    database => "/usr/local/logstash/logstash-1.4.0/vendor/geoip/GeoLiteCity.dat"
    add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
    add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
  }
  mutate {
    convert => [ "[geoip][coordinates]", "float" ]
  }
}
output {
  elasticsearch {
    bind_host => "192.168.0.10"
    host => "es.domain.com"
    protocol => "http"
  }
}