ELK版本 7.13.1
kibana.yml
map.tilemap.url: 'http://webrd02.is.autonavi.com/appmaptile?lang=zh_cn&size=1&scale=1&style=7&x={x}&y={y}&z={z}'
下载geoIp
https://www.maxmind.com/en/accounts/596018/geoip/downloads
解压到指定目录
logstash.conf
input {
file {
path => "D:/logstash.log"
start_position => "beginning"
}
}
filter {
mutate {
gsub => ["message", "\n", ""]
gsub => ["message", "\r", ""]
gsub => ["message", "\"", ""]
}
geoip {
source => "message"
target => "geo"
add_field => ["date", "%{+YYYY-MM}"]
database => "D:/data/GeoLite2-City_20210817/GeoLite2-City.mmdb"
fields => ["country_name", "continent_code", "region_name", "city_name", "latitude", "longitude"]
add_field => ["[geo][coordinates]","%{[geo][longitude]}"]
add_field => ["[geo][coordinates]","%{[geo][latitude]}"]
}
mutate {
convert => [ "[geo][coordinates]", "float" ]
}
}
output {
elasticsearch {
hosts => "localhost:9200"
index => "logstash"
}
stdout {
codec => rubydebug
}
}
启动es, 创建索引, 并指定geo数据类型
PUT logstash
{
"settings": {
"number_of_shards": 3,
"number_of_replicas": 1
}
}
PUT logstash/_mapping
{
"properties": {
"geo" : {
"properties" : {
"coordinates" : {
"type" : "geo_point"
}
}
}
}
}
geo_point 这个类型很重要, 否则不能创建map, 报错提示:
Index pattern does not contain any geospatial fields
创建 index pattern
指定index, 选择对应的field
logstash.log中添加ip地址
在线随机生成2000IP地址
http://www.ab126.com/web/10725.html
查询es中index doc个数
GET logstash/_count