Added destination information for redir traffic (haproxy)
@@ -164,6 +164,36 @@ filter {
}
}
+ # Add destination.ip
+ if [redir][frontend][ip] {
+ mutate {
+ add_field => { "[destination][ip]" => "%{[redir][frontend][ip]}" }
+ }
+ # add geo ip info from City DB
+ geoip {
+ source => "[destination][ip]"
+ target => "tmpgeoip"
+ }
+ # add geo ip info from ASN DB
+ geoip {
+ source => "[destination][ip]"
+ target => "tmpgeoip"
+ default_database_type => "ASN"
+ }
+ mutate {
+ copy => {
+ "[tmpgeoip][as_org]" => "[destination][as][organization][name]"
+ "[tmpgeoip][asn]" => "[destination][as][number]"
+ "[tmpgeoip][city_name]" => "[destination][geo][city_name]"
+ "[tmpgeoip][country_code2]" => "[destination][geo][country_iso_code]"
+ "[tmpgeoip][location]" => "[destination][geo][location]"
+ "[tmpgeoip][region_code]" => "[destination][geo][region_iso_code]"
+ "[tmpgeoip][region_name]" => "[destination][geo][region_name]"
+ }
+ remove_field => [ "tmpgeoip" ]
+ }
+ }
+
# Add data to the redirraffic.sourceip
if [source][ip] {
# duplicate field so we can replace it with reverse DNS lookup
