安装GeoIP数据库

1.安装GeoIP数据库

cd /usr/local/logstash/etc
curl -O "http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz"
gunzip GeoLiteCity.dat.gz
1
2
3
2.配置logstash使用GeoIP

只需要在原来的logstash.conf中添加filter即可

vim /usr/local/logstash/etc/logstash.conf
input {
        file {
                path => "/data/nginx/logs/access_java.log"
                type => "nginx-access"
                start_position => "beginning"
                sincedb_path => "/usr/local/logstash/sincedb"
                codec => "json"
        }
}
filter {
        if [type] == "nginx-access" {
                geoip {
                        source => "clientip"
                        target => "geoip"
                        database => "/usr/local/logstash/etc/GeoLiteCity.dat"
                        add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
                        add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
                }
                mutate {
                        convert => [ "[geoip][coordinates]", "float"]
                }
        }
}
output {
        if [type] == "nginx-access" {
                elasticsearch {
                        hosts => ["10.10.20.16:9200"]
                        manage_template => true
                        index => "nginx-access-%{+YYYY-MM}"
                }
        }

}

注意如果是haproxy 作为代理,nginx需要修改为；
filter {
    grok {
        match => {
             "message" => "%{IPORHOST:clientip} \[%{HTTPDATE:time}\] \"%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" \- %{NUMBER:http_status_code} %{NUMBER:bytes} \"(?<http_referer>\S+)\" \"(?<http_user_agent>(\S+\s+)*\S+)\" (%{BASE16FLOAT:request_time}) (%{IPORHOST:http_x_forwarded_for}|-)"
        }
    }
        geoip {
                        source => "http_x_forwarded_for"
                        target => "geoip"
                        database => "/usr/local/logstash/etc/GeoLiteCity.dat"
                        add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
                        add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
                }
                mutate {
                        convert => [ "[geoip][coordinates]", "float"]
                }

}

3.重启logstash即可。