github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-04-23 22:27:21 -04:00
Code Issues Projects Releases Packages Wiki Activity

Updated geofilter breaking changes

Browse source 
Added note about _geoip_lookup_failure

Fixes #6333
This commit is contained in:
Glen Smith 2016-11-30 11:48:29 -07:00 • committed by Suyog Rao
parent 86ef0d9190
commit e11694b317
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/static/breaking-changes.asciidoc vendored
View file

@ -240,6 +240,12 @@ The GeoIP filter has been updated to use MaxMind's GeoIP2 database. Previous Geo
by MaxMind. As a result of this, `.dat` version files are no longer supported, and only `.mmdb` format is supported.
The new database will not include ASN data in the basic free database file.
Previously, when the filter encountered an IP address for which there were no results in the database, the event
would just pass through the filter without modification. It will now add a `_geoip_lookup_failure` tag to the
event which will allow for some subsequent stage of the pipeline to identify those events and perform some other
operation. To simply get the same behavior as the earlier versions, just add a filter conditional on that tag
which then drops the tag from the event.
[float]
=== Ruby Filter and Custom Plugin Developers