EFK实现GeoIP定位全球访客

#配置fluentd

[root@fluent ~]# vim etc/td-agent/td-agent.conf

<source>

  @type tail

  path var/log/nginx/access_json.log

  pos_file var/log/nginx/access_json.log.pos

  tag nginx_json.access

  format json

  time_format %d/%b/%Y:%H:%M:%S %z

</source>

[root@logstash ~]# yum install GeoIP-data -y

[root@logstash ~]# vim etc/logstash/conf.d/kafka_log_es.conf

filter{

        if [remote] != "-" {

                geoip {

                        source => "remote"

                        target => "geoip"

                        # database => "/usr/share/GeoIP/GeoIPCity.dat"

                        add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]

                        add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]

                        }

                mutate {

                        convert => [ "[geoip][coordinates]", "float"]

                }

        }

}

[root@logstash ~]# vim etc/logstash/conf.d/kafka_log_es.conf

output {

   elasticsearch {

        hosts => ["http://node1.elastic.test.com:9200","http://node2.elastic.test.com:9200"]

        index => "logstash-nginx-log-%{+YYYY.MM}"

        codec => "json"

   }

}