日志中ip地址位置解析

qq_935417654

已于 2024-07-08 22:52:20 修改

阅读量230

点赞数 1

分类专栏：监控之日志-logstash 文章标签： elasticsearch

于 2024-07-08 22:48:16 首次发布

本文链接：https://blog.csdn.net/qq_35013224/article/details/140280726

版权

监控之日志-logstash 专栏收录该内容

2 篇文章 0 订阅

订阅专栏

方法一、使用logstash解析

input {
        redis {
                host => "1。1.1.1"
                port => 6379
                db => 0
                data_type => "list"
                key => "LogstashXxx"
                password => "password"
                type => "xx_Nginx_Log"
        }

}

filter {
       if [type] == "xx_Nginx_Log" {
         geoip {
               source => "remote_addr"
               target => "geoip"
               database => "/etc/logstash/plugins/GeoLite2-City.mmdb"
              }
}

output {

        if [type] == "xx_Nginx_Log" {
        elasticsearch {
          hosts => ["1.1.1.2:9200"]
          index => "xx-%{+YYYY.MM.dd}"
          user => elastic
          password => XxxxxPassword
          }
        }

}

	#stdout { codec => rubydebug }

方法二、使用es的pipline管道

1 配置pipeline

PUT _ingest/pipeline/geoip

{
  "description" : "Add geoip info",
  "processors" : [
    {
      "geoip" : {
        "field" : "http_x_forwarded_for"
      }
    }
  ]
}

替换 http_x_forwarded_for 为任意适合你的变量

2 配置模板

PUT _template/logstash
{
    "order": 0,
    "version": 60001,
    "index_patterns": [
      "logstash-*"
    ],
    "settings": {
      "index": {
        "default_pipeline": "geoip"
      }
    }
}

效果：略