安装GeoIP数据库

1. 1.安装GeoIP数据库  
2.   
3. cd /usr/local/logstash/etc  
4. curl -O "http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz"  
5. gunzip GeoLiteCity.dat.gz  
6. 1  
7. 2  
8. 3  
9. 2.配置logstash使用GeoIP  
10.   
11. 只需要在原来的logstash.conf中添加filter即可  
12.   
13. vim /usr/local/logstash/etc/logstash.conf  
14. input {  
15.         file {  
16.                 path => "/data/nginx/logs/access_java.log"  
17.                 type => "nginx-access"  
18.                 start_position => "beginning"  
19.                 sincedb_path => "/usr/local/logstash/sincedb"  
20.                 codec => "json"  
21.         }  
22. }  
23. filter {  
24.         if [type] == "nginx-access" {  
25.                 geoip {  
26.                         source => "clientip"  
27.                         target => "geoip"  
28.                         database => "/usr/local/logstash/etc/GeoLiteCity.dat"  
29.                         add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]  
30.                         add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]  
31.                 }  
32.                 mutate {  
33.                         convert => [ "[geoip][coordinates]", "float"]  
34.                 }  
35.         }  
36. }  
37. output {  
38.         if [type] == "nginx-access" {  
39.                 elasticsearch {  
40.                         hosts => ["10.10.20.16:9200"]  
41.                         manage_template => true  
42.                         index => "nginx-access-%{+YYYY-MM}"  
43.                 }  
44.         }  
45.   
46. }  
47.   
48. 注意如果是haproxy 作为代理,nginx需要修改为；  
49. filter {  
50.     grok {  
51.         match => {  
52.              "message" => "%{IPORHOST:clientip} 
     \"%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" \- %{NUMBER:http_status_code} %{NUMBER:bytes} \"(?<http_referer>\S+)\" \"(?<http_user_agent>(\S+\s+)*\S+)\" (%{BASE16FLOAT:request_time}) (%{IPORHOST:http_x_forwarded_for}|-)"  
53.         }  
54.     }  
55.         geoip {  
56.                         source => "http_x_forwarded_for"  
57.                         target => "geoip"  
58.                         database => "/usr/local/logstash/etc/GeoLiteCity.dat"  
59.                         add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]  
60.                         add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]  
61.                 }  
62.                 mutate {  
63.                         convert => [ "[geoip][coordinates]", "float"]  
64.                 }  
65.   
66. }  
67.   
68.   
69.   
70.   
71. 3.重启logstash即可。