Using a free database for the Geoip logstash feature

75 Views Asked by At

I have enabled the geoip of logstash plugin, but I cannot manually insert the database I want into the config file and it keeps giving the following error. I didn't understand this exactly, the geoip function just needs to be activated on the logstash. Do I have a mistake in the pipeline config file?What is the difference between dat and your mmbr extension in your maxmind databases?

pipeline:

filter {
   grok {
      match => { "message" => "%{IP:clientip} - %{DATA:user_name} \[%{HTTPDATE:access_time}\] \"%{WORD:http_method} %{DATA:url} HTTP/%{NUMBER:http_version}\" %{NUMBER:response_code} %{NUMBER:body_sent_bytes} \"%{DATA:referrer}\" \"%{GREEDYDATA:agent}" }
        }
   geoip {
       source => "[clientip]"
       ecs_compatibility => disabled
       target => "geoip"
       database => “/usr/share/logstash/database/GeoIPCity.dat”
    }

error log: image attach enter image description here

0

There are 0 best solutions below