使用elk监控文件根据ip地址在map地图上分布显示

ELK版本 7.13.1

kibana.yml

map.tilemap.url: 'http://webrd02.is.autonavi.com/appmaptile?lang=zh_cn&size=1&scale=1&style=7&x={x}&y={y}&z={z}'

下载geoIp
https://www.maxmind.com/en/accounts/596018/geoip/downloads
解压到指定目录

logstash.conf

input {
    file {
        path => "D:/logstash.log"
        start_position => "beginning"
    }
}


filter {
	mutate {
		gsub => ["message", "\n", ""]
		gsub => ["message", "\r", ""]
		gsub => ["message", "\"", ""]
	}
	
	geoip {
		source => "message"
		target => "geo"
		add_field => ["date", "%{+YYYY-MM}"]
		database => "D:/data/GeoLite2-City_20210817/GeoLite2-City.mmdb"
		fields => ["country_name", "continent_code", "region_name", "city_name", "latitude", "longitude"]
		add_field => ["[geo][coordinates]","%{[geo][longitude]}"]
		add_field => ["[geo][coordinates]","%{[geo][latitude]}"]
	}
	
	mutate {
		convert => [ "[geo][coordinates]", "float" ]
	}
}

output {
	elasticsearch {
		hosts => "localhost:9200"
		index => "logstash"
	}
	stdout {
        codec => rubydebug
    }
}

启动es, 创建索引, 并指定geo数据类型

PUT logstash
{
  "settings": {
		"number_of_shards": 3,
		"number_of_replicas": 1
	}
}

PUT logstash/_mapping
{
  "properties": {
    "geo" : {
          "properties" : {
            "coordinates" : {
              "type" : "geo_point"
            }
          }
        }
  }
}

geo_point 这个类型很重要, 否则不能创建map, 报错提示:
Index pattern does not contain any geospatial fields

创建 index pattern

指定index, 选择对应的field

logstash.log中添加ip地址

在线随机生成2000IP地址
http://www.ab126.com/web/10725.html

查询es中index doc个数

GET logstash/_count