github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-04-24 22:57:16 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #1115 from kurtado/doc/filter/geoip

Browse source 
geoip touchup
This commit is contained in:
Kurt Hurtado 2014-02-28 12:01:58 -08:00
commit 1566e3b0e8
1 changed files with 18 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

36
lib/logstash/filters/geoip.rb
View file

@ -3,16 +3,16 @@ require "logstash/filters/base"
require "logstash/namespace" require "logstash/namespace"
require "tempfile" require "tempfile"
# Add GeoIP fields from Maxmind database # The GeoIP filter adds information about the geographical location of IP addresses,
# based on data from the Maxmind database.
# #
# GeoIP filter, adds information about the geographical location of IP addresses. # Starting with version 1.3.0 of Logstash, a [geoip][location] field is created if
#
# Starting at version 1.3.0 of logstash, a [geoip][location] field is created if
# the GeoIP lookup returns a latitude and longitude. The field is stored in # the GeoIP lookup returns a latitude and longitude. The field is stored in
# [GeoJSON](http://geojson.org/geojson-spec.html) format. Additionally, # [GeoJSON](http://geojson.org/geojson-spec.html) format. Additionally,
# the default Elasticsearch template provided with the # the default Elasticsearch template provided with the
# [elasticsearch output](../outputs/elasticsearch.html) # [elasticsearch output](../outputs/elasticsearch.html)
# maps the [geoip][location] field to a [geo_point](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/mapping-geo-point-type.html). # maps the [geoip][location] field to a
# [geo_point](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/mapping-geo-point-type.html).
# #
# As this field is a geo\_point _and_ it is still valid GeoJSON, you get # As this field is a geo\_point _and_ it is still valid GeoJSON, you get
# the awesomeness of Elasticsearch's geospatial query, facet and filter functions # the awesomeness of Elasticsearch's geospatial query, facet and filter functions
@ -26,34 +26,34 @@ class LogStash::Filters::GeoIP < LogStash::Filters::Base
config_name "geoip" config_name "geoip"
milestone 1 milestone 1
# GeoIP database file to use, Country, City, ASN, ISP and organization # The path to the GeoIP database file which Logstash should use. Country, City, ASN, ISP
# databases are supported # and organization databases are supported.
# #
# If not specified, this will default to the GeoLiteCity database that ships # If not specified, this will default to the GeoLiteCity database that ships
# with logstash. # with Logstash.
config :database, :validate => :path config :database, :validate => :path
# The field containing the IP address or hostname to map via geoip. If # The field containing the IP address or hostname to map via geoip. If
# this field is an array, only the first value will be used. # this field is an array, only the first value will be used.
config :source, :validate => :string, :required => true config :source, :validate => :string, :required => true
# Array of geoip fields that we want to be included in our event. # An array of geoip fields to be included in the event.
# #
# Possible fields depend on the database type. By default, all geoip fields # Possible fields depend on the database type. By default, all geoip fields
# are included in the event. # are included in the event.
# #
# For the built in GeoLiteCity database, the following are available: # For the built-in GeoLiteCity database, the following are available:
# city\_name, continent\_code, country\_code2, country\_code3, country\_name, # `city\_name`, `continent\_code`, `country\_code2`, `country\_code3`, `country\_name`,
# dma\_code, ip, latitude, longitude, postal\_code, region\_name, timezone # `dma\_code`, `ip`, `latitude`, `longitude`, `postal\_code`, `region\_name` and `timezone`.
config :fields, :validate => :array config :fields, :validate => :array
# Specify into what field you want the geoip data. # Specify the field into which Logstash should store the geoip data.
# This can be useful for example if you have a src\_ip and dst\_ip and want # This can be useful, for example, if you have `src\_ip` and `dst\_ip` fields and
# information of both IP's. # would like the GeoIP information of both IPs.
# #
# If you save the data to another target than "geoip" and want to use the # If you save the data to a target field other than "geoip" and want to use the
# geo\_point related functions in elasticsearch, you need to alter the template # geo\_point related functions in Elasticsearch, you need to alter the template
# provided with the elasticsearch output and configure the output to use the # provided with the Elasticsearch output and configure the output to use the
# new template. # new template.
# #
# Even if you don't use the geo\_point mapping, the [target][location] field # Even if you don't use the geo\_point mapping, the [target][location] field