elk 使用geoip添加地图展示

logstash

查看可用插件

 /usr/share/logstash/bin/logstash-plugin list --verbose 

安装插件

/usr/share/logstash/bin/logstash-plugin install logstash-filter-geoip
/usr/share/logstash/bin/logstash-plugin install logstash-filter-mutate
/usr/share/logstash/bin/logstash-plugin install logstash-filter-useragent

下载地图包

# cd /etc/logstash/db
# wget https://geolite.maxmind.com/download/geoip/database/GeoLite2-City.tar.gz
# tar xf GeoLite2-City.tar 
# cd GeoLite2-City_20190305
# cp GeoLite2-City.mmdb ../

geoip配置

geoip {
        # 源为字段alicdn.clientip，见patterns
        source => "[alicdn]clientip"
        # 目标默认为geoip
        target => "geoip"
        # 使用刚下载的地图包
        database => "/etc/logstash/db/GeoLite2-City.mmdb"
        # 添加字段，值为经度
        add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
        # 添加字段，值为纬度
        add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
      }
mutate {
  # 定义经纬度字段值为float格式
  convert => [ "[geoip][coordinates]", "float"]
       }
useragent {
  source => "[alicdn]agent"
  target => "agent"
          }

kibana

1. 选择Visualize
2. 新建new
3. 选择coordinate map
4. 选择logstash-alicdn*
5. Metrics - Aggregation:count
6. buckets - Aggregation:Geohash - Field:geoip.location
7. 保存