logstash geoip过滤器返回_geoip_lookup_failure

Question

我正在做logstash。我已成功安装logstash-filter-geoip

但是当我尝试使用它时，它返回_geoip_lookup_failure thi在我的logstash.conf文件中

filter{
    geoip {
    source => "clientip"
  }
}

这是我对logstash的输入

 55.3.244.1 GET /index.html 15824 0.043

如果它返回

{
    "duration" => "0.043",
    "request" => "/index.html",
    "@timestamp" => 2017-07-25T14:33:30.495Z,
    "method" => "GET",
    "bytes" => "15824",
    "@version" => "1",
    "host" => "DEs-0033",
    "client" => "55.3.244.1",
    "message" => "55.3.244.1 GET /index.html 15824 0.043",
    "tried to use this it returns _geoip_lookup_failuretags" => [
        [0] "_geoip_lookup_failure"
    ]
}

Answer 1

尝试使用client而不是clientip。

filter{
    geoip {
    source => "client"
  }
}

Answer 2

clientip字段在您的案例中不存在。您必须使用client字段。

另一方面，你可以查看IP2Location filter plugin tutorial，它提供了你正在做的事情的例子。例如：

filter {
  grok {
    match => { "message" => "%{COMBINEDAPACHELOG}"}
  }
  ip2location {
    source => "clientip"
  }
}