安装GeoIP数据库
来源:互联网 发布:20式82毫米迫击炮数据 编辑:程序博客网 时间:2024/06/06 17:03
- 1.安装GeoIP数据库
-
- cd /usr/local/logstash/etc
- curl -O "http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz"
- gunzip GeoLiteCity.dat.gz
- 1
- 2
- 3
- 2.配置logstash使用GeoIP
-
- 只需要在原来的logstash.conf中添加filter即可
-
- vim /usr/local/logstash/etc/logstash.conf
- input {
- file {
- path => "/data/nginx/logs/access_java.log"
- type => "nginx-access"
- start_position => "beginning"
- sincedb_path => "/usr/local/logstash/sincedb"
- codec => "json"
- }
- }
- filter {
- if [type] == "nginx-access" {
- geoip {
- source => "clientip"
- target => "geoip"
- database => "/usr/local/logstash/etc/GeoLiteCity.dat"
- add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
- add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
- }
- mutate {
- convert => [ "[geoip][coordinates]", "float"]
- }
- }
- }
- output {
- if [type] == "nginx-access" {
- elasticsearch {
- hosts => ["10.10.20.16:9200"]
- manage_template => true
- index => "nginx-access-%{+YYYY-MM}"
- }
- }
-
- }
-
- 注意如果是haproxy 作为代理,nginx需要修改为;
- filter {
- grok {
- match => {
- "message" => "%{IPORHOST:clientip}
\"%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" \- %{NUMBER:http_status_code} %{NUMBER:bytes} \"(?<http_referer>\S+)\" \"(?<http_user_agent>(\S+\s+)*\S+)\" (%{BASE16FLOAT:request_time}) (%{IPORHOST:http_x_forwarded_for}|-)" - }
- }
- geoip {
- source => "http_x_forwarded_for"
- target => "geoip"
- database => "/usr/local/logstash/etc/GeoLiteCity.dat"
- add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
- add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
- }
- mutate {
- convert => [ "[geoip][coordinates]", "float"]
- }
-
- }
-
-
-
-
- 3.重启logstash即可。
0 0