通过geoip插件可以获取IP对应的地理位置信息。
1、基本用法
插件配置：
filter {
geoip {
source => "message"
}
}
输出结果：
{
"message" => "183.60.92.253",
"@version" => "1",
"@timestamp" => "2014-08-07T10:32:55.610Z",
"host" => "raochenlindeMacBook-Air.local",
"geoip" => {
"ip" => "183.60.92.253",
"country_code2" => "CN",
"country_code3" => "CHN",
"country_name" => "China",
"continent_code" => "AS",
"region_name" => "30",
"city_name" => "Guangzhou",
"latitude" => 23.11670000000001,
"longitude" => 113.25,
"timezone" => "Asia/Chongqing",
"real_region_name" => "Guangdong",
"location" => [
[0] 113.25,
[1] 23.11670000000001
]
}
}
从上面的输出结果，可以看出，geoip插件解析出的IP物理位置信息包括：
国家、洲、市、经纬度、时区、区域名称等。
2、其它选项
geoip 提供的可选选项包括：
通过 fields 选项可以进行字段筛选：
filter {
geoip {
fields => ["city_name", "continent_code","country_name", "ip", "latitude", "longitude", "postal_code", "region_name", "timezone"]
}
}
