1

我想在 Kibana 中创建一个平铺地图，以显示来自世界各国的源 IP。尝试设置平铺地图时，我收到一条错误消息，提示““logstash-*”索引模式不包含以下任何字段类型：geo_point”

我用谷歌搜索了这个问题并找到了这个链接https://github.com/elastic/logstash/issues/3137并且在该页面的末尾，它指出这是在 2.x 中修复的。但我在2.1。

这是我的配置：

1inputs.conf：

   input {
   udp {
    type => "syslog"
    port => 5140
     }
    }

5pfsense.conf：

filter {
    # Replace with your IP
    if [host] =~ /10\.1\.15\.200/ {
        grok {
           match => [ 'message', '.* %{WORD:program}:%{GREEDYDATA:rest}' ]
        }

        if [program] == "filterlog" {
            # Grab fields up to IP version. The rest will vary depending on IP version.
            grok {
                match => [ 'rest', '%{INT:rule_number},%{INT:sub_rule_number},,%{INT:tracker_id},%{WORD:interface},%{WORD:reason},%{WORD:action},%{WORD:direction},%{WORD:ip_version},%{GREEDYDATA:rest2}' ]
            }
        }

        mutate {
          replace => [ 'message', '%{rest2}' ]
        }

        if [ip_version] == "4" {
            # IPv4. Grab field up to dest_ip. Rest can vary.
            grok {
                match => [ 'message', '%{WORD:tos},,%{INT:ttl},%{INT:id},%{INT:offset},%{WORD:flags},%{INT:protocol_id},%{WORD:protocol},%{INT:length},%{IP:src_ip},%{IP:dest_ip},%{GREEDYDATA:rest3}' ]
            }
        }

        if [protocol_id] != 2 {
            # Non-IGMP has more fields.
            grok {
                match => [ 'rest3', '^%{INT:src_port:int},%{INT:dest_port:int}' ]
            }
        }

        else {
            # IPv6. Grab field up to dest_ip. Rest can vary.
            grok {
                match => [ 'message', '%{WORD:class},%{WORD:flow_label},%{INT:hop_limit},%{WORD:protocol},%{INT:protocol_id},%{INT:length},%{IPV6:src_ip},%{IPV6:dest_ip},%{GREEDYDATA:rest3}' ]
            }
        }

        mutate {
            replace => [ 'message', '%{rest3}' ]
            lowercase => [ 'protocol' ]
        }

        if [message] {
            # Non-ICMP has more fields
            grok {
                match => [ 'message', '^%{INT:src_port:int},%{INT:dest_port:int},%{INT:data_length}' ]
            }
        }

        mutate {
            remove_field => [ 'message' ]
            remove_field => [ 'rest' ]
            remove_field => [ 'rest2' ]
            remove_field => [ 'rest3' ]
            remove_tag => [ '_grokparsefailure' ]
            add_tag => [ 'packetfilter' ]
        }

        geoip {
            add_tag => [ "GeoIP" ]
            source => "src_ip"
        }
    }
}

最后，50outputs.conf：

output {
elasticsearch { hosts => localhost index => "logstash-%{+YYYY.MM.dd}" template_overwrite => "true" }
stdout { codec => rubydebug }
}
4

0 回答 0