通過(guò)geoip插件可以獲取IP對(duì)應(yīng)的地理位置信息。

1、基本用法

插件配置：

filter {
    geoip {
        source => "message"
    }
}

輸出結(jié)果：

{
    "message" => "183.60.92.253",
    "@version" => "1",
    "@timestamp" => "2014-08-07T10:32:55.610Z",
    "host" => "raochenlindeMacBook-Air.local",
    "geoip" => {
        "ip" => "183.60.92.253",
        "country_code2" => "CN",
        "country_code3" => "CHN",
        "country_name" => "China",
        "continent_code" => "AS",
        "region_name" => "30",
        "city_name" => "Guangzhou",
        "latitude" => 23.11670000000001,
        "longitude" => 113.25,
        "timezone" => "Asia/Chongqing",
        "real_region_name" => "Guangdong",
        "location" => [
            [0] 113.25,
            [1] 23.11670000000001
        ]
    }
}

從上面的輸出結(jié)果，可以看出，geoip插件解析出的IP物理位置信息包括：
國(guó)家、洲、市、經(jīng)緯度、時(shí)區(qū)、區(qū)域名稱等。

2、其它選項(xiàng)

geoip 提供的可選選項(xiàng)包括：

通過(guò) fields 選項(xiàng)可以進(jìn)行字段篩選：

filter {
    geoip {
        fields => ["city_name", "continent_code","country_name",  "ip", "latitude", "longitude", "postal_code", "region_name", "timezone"]
    }
}