Added geoip data from ip_ext field
@@ -132,7 +132,38 @@ filter {
}
if [host][ip_ext] {
mutate {
- add_field => { "[host][ip]" => "%{[host][ip_ext]}" }
+ add_field => { "[host][domain_ext]" => "%{[host][ip_ext]}" }
+ copy => { "[host][ip_ext]" => "[host][ip]" }
+ }
+ # do reverse DNS lookup
+ dns {
+ reverse => ["[host][domain_ext]"]
+ action => "replace"
+ timeout => "2.0"
+ }
+ # add geo ip info from City DB
+ geoip {
+ source => "[host][ip_ext]"
+ target => "tmpgeoip"
+ }
+ # add geo ip info from ASN DB
+ geoip {
+ source => "[host][ip_ext]"
+ target => "tmpgeoip"
+ default_database_type => "ASN"
+ database => "/usr/share/elasticsearch/modules/ingest-geoip/GeoLite2-ASN.mmdb"
+ }
+ mutate {
+ copy => {
+ "[tmpgeoip][as_org]" => "[host][geo][as][organization][name]"
+ "[tmpgeoip][asn]" => "[host][geo][as][organization][number]"
+ "[tmpgeoip][city_name]" => "[host][geo][city_name]"
+ "[tmpgeoip][country_code2]" => "[host][geo][country_iso_code]"
+ "[tmpgeoip][location]" => "[host][geo][location]"
+ "[tmpgeoip][region_code]" => "[host][geo][region_iso_code]"
+ "[tmpgeoip][region_name]" => "[host][geo][region_name]"
+ }
+ remove_field => [ "tmpgeoip" ]
}
}
