使用logstash的geoip filter, 可以將訪問的IP轉(zhuǎn)換成經(jīng)緯度, 這里需要注意的是，在地圖上展示的字段類型必須是geo_point, 這樣就需要將geoip filter解析的geoip.location字段類型指定成geo_point;
建立nginx日志的索引模版，將geoip.location的type指定稱為geo_point
注意：當(dāng)logstash將數(shù)據(jù)output到ES中會默認(rèn)建立一個索引模版酬诀，可以通過
curl -XGET 'http://ip:ip_port/_template查看到拔第， 這里已經(jīng)將geo.localtion字段的type指定成了geo_point, 如果你索引名使用logstash-*就不需要自己在去指定索引模版了史辙；
curl -XPUT 'http://ip:ip_port/_template/template_ngx' -d
'
{
"template": "ngx*",
"settings": {
"index": {
"refresh_interval": "5s",
"number_of_shards": "3",
"number_of_replicas": "1"
}
},
"mappings": {
"_default_": {
"dynamic_templates": [
{
"message_field": {
"path_match": "message",
"mapping": {
"norms": false,
"type": "text"
},
"match_mapping_type": "string"
}
},
{
"string_fields": {
"mapping": {
"norms": false,
"type": "text",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"match_mapping_type": "string",
"match": "*"
}
}
],
"_all": {
"norms": false,
"enabled": true
},
"properties": {
"@timestamp": {
"include_in_all": false,
"type": "date"
},
"geoip": {
"dynamic": true,
"properties": {
"ip": {
"type": "ip"
},
"latitude": {
"type": "half_float"
},
"location": {
"type": "geo_point"
},
"longitude": {
"type": "half_float"
}
}
},
"@version": {
"include_in_all": false,
"type": "keyword"
}
}
}
},
"aliases": {}
}
'
使用grafana的worldmap展示的時候份氧，需要注意的點：
- Metrics頁面Group by使用ES中點geoip.location字段
WX20170728-115757.png
- Worldmap的Map Data Options也需要將Location Data指定為geohash
WX20170728-115824.png
