{"action":"created","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-geoip/issues/37","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-geoip/issues/37/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-geoip/issues/37/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-geoip/issues/37/events","html_url":"https://github.com/logstash-plugins/logstash-filter-geoip/issues/37","id":104841795,"number":37,"title":"Geoip configuration problems","user":{"login":"dfaropennetwork","id":13537268,"avatar_url":"https://avatars.githubusercontent.com/u/13537268?v=3","gravatar_id":"","url":"https://api.github.com/users/dfaropennetwork","html_url":"https://github.com/dfaropennetwork","followers_url":"https://api.github.com/users/dfaropennetwork/followers","following_url":"https://api.github.com/users/dfaropennetwork/following{/other_user}","gists_url":"https://api.github.com/users/dfaropennetwork/gists{/gist_id}","starred_url":"https://api.github.com/users/dfaropennetwork/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dfaropennetwork/subscriptions","organizations_url":"https://api.github.com/users/dfaropennetwork/orgs","repos_url":"https://api.github.com/users/dfaropennetwork/repos","events_url":"https://api.github.com/users/dfaropennetwork/events{/privacy}","received_events_url":"https://api.github.com/users/dfaropennetwork/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-09-04T07:23:22Z","updated_at":"2015-09-21T15:37:18Z","closed_at":null,"body":"Hi All\r\n\r\nI've problems with mi geoip ip configuration, i've kibana 4.1.1 with logstash 1.5.3 and apache 2.4.\r\n\r\nThis is my personalized geoip file configuration on logstash, i called 12-geoip.conf :\r\n\r\nfilter {\r\n  if [type] == \"apache_access\" {\r\n    grok {\r\n      match => { \"message\" => \"%{COMMONAPACHELOG}\" } \r\n\r\n  }\r\n   geoip {\r\n      source => \"clientip\"\r\n      target => \"geoip.location\"\r\n      database => \"/etc/logstash/GeoLiteCity.dat\"\r\n      add_field => [ \"[geoip.location][coordinates]\", \"%{[geoip.location][longitude]}\" ]\r\n      add_field => [ \"[geoip.location][coordinates]\", \"%{[geoip.location][latitude]}\"  ]\r\n    }\r\n    mutate {\r\n      convert => [ \"[geoip.location][coordinates]\", \"float\"]\r\n    }\r\n  }\r\n }\r\n\r\nMi apache configuration on other file\r\nfilter {\r\n  if [type] == \"apache\" {\r\n    grok {\r\n      match => { \"message\" => \"%{COMBINEDAPACHELOG}\" }\r\n      add_field => [ \"received_from\", \"%{host}\" ]\r\n   }\r\n  }\r\n }\r\n\r\nMy problem is that Kibana don't appears the \"geoip\" field, but clientip, hostname, etc.... appears. \r\n\r\nPart of my logstash-forwarder configuration\r\n\r\n    {\r\n      \"paths\": [\r\n        \"/var/log/apache2/*error.log\",\r\n        \"/var/log/apache2/*access-ssl.log\"\r\n       ],\r\n      \"fields\": { \"type\": \"apache\" }\r\n    },\r\n    {\r\n      \"paths\": [\r\n        \"/var/log/apache2/*access.log\"\r\n       ],\r\n      \"fields\": { \"type\": \"apache_access\" }\r\n     }\r\n  ]\r\n}\r\n\r\nAnd my logstash-forwarder registered events:\r\n\r\n2015/09/04 09:07:57.807119 Registrar: processing 5 events\r\n2015/09/04 09:08:45.244783 Registrar: processing 2 events\r\n2015/09/04 09:08:50.238178 Registrar: processing 2 events\r\n2015/09/04 09:09:02.744967 Registrar: processing 1 events\r\n\r\n\r\nThax so much."},"comment":{"url":"https://api.github.com/repos/logstash-plugins/logstash-filter-geoip/issues/comments/142017753","html_url":"https://github.com/logstash-plugins/logstash-filter-geoip/issues/37#issuecomment-142017753","issue_url":"https://api.github.com/repos/logstash-plugins/logstash-filter-geoip/issues/37","id":142017753,"user":{"login":"pioneerit","id":794315,"avatar_url":"https://avatars.githubusercontent.com/u/794315?v=3","gravatar_id":"","url":"https://api.github.com/users/pioneerit","html_url":"https://github.com/pioneerit","followers_url":"https://api.github.com/users/pioneerit/followers","following_url":"https://api.github.com/users/pioneerit/following{/other_user}","gists_url":"https://api.github.com/users/pioneerit/gists{/gist_id}","starred_url":"https://api.github.com/users/pioneerit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pioneerit/subscriptions","organizations_url":"https://api.github.com/users/pioneerit/orgs","repos_url":"https://api.github.com/users/pioneerit/repos","events_url":"https://api.github.com/users/pioneerit/events{/privacy}","received_events_url":"https://api.github.com/users/pioneerit/received_events","type":"User","site_admin":false},"created_at":"2015-09-21T15:37:18Z","updated_at":"2015-09-21T15:37:18Z","body":"Thanks for link to https://discuss.elastic.co\r\nI found solution with bruteforce :)\r\nAnd after I found that link with explanation - https://logstash.jira.com/browse/LOGSTASH-2128\r\n\r\n@dfaropennetwork, I think you should try simple config, because all other values by default exist without any mutate and etc...\r\nReplace geoip and mutate with this:\r\ngeoip {\r\n  source => \"clientip\"\r\n  database => \"/etc/logstash/GeoLiteCity.dat\"\r\n}\r\n\r\nAnd if you will have any problems, join to https://discuss.elastic.co"}}