0

我試圖創建一個瓦片地圖Kibana。我的conf文件logstash正常工作,並生成Kibana需要繪製瓦片地圖的所有內容。這是我的conf logstash:情節瓦片地圖與ELK棧

input { 
    file { 
      path => "/home/ec2-user/part.csv" 
      start_position => "beginning" 
      sincedb_path => "/dev/null" 
    } 
} 

filter { 

    csv { 
      separator => "," 
      columns => ["kilo_bytes_total","ip","session_number","request_number_total","duration_minutes_total","referer_list","filter_match_count_avg","request_number_avg","duration_minutes_avg","kilo_bytes_avg","segment_duration_avg","req_by_minute_avg","segment_mix_rank_avg","offset_avg_avg","offset_std_avg","extrem_interval_count_avg","pf0_avg","pf1_avg","pf2_avg","pf3_avg","pf4_avg","code_0_avg","code_1_avg","code_2_avg","code_3_avg","code_4_avg","code_5_avg","volume_classification_filter_avg","code_classification_filter_avg","profiles_classification_filter_avg","strange_classification_filter_avg"] 

    } 



    geoip { 

     source => "ip" 
     database => "/home/ec2-user/logstash-5.2.0/GeoLite2-City.mmdb" 
     target => "geoip" 
     add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ] 
     add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ] 
     add_tag => "geoip" 

    } 


    mutate { 

    convert => [ "[geoip][coordinates]", "float"] 

    } 

} 




output { 

    elasticsearch { 

    index => "geotrafficip" 
    } 
} 

這是產生什麼:

enter image description here

它看起來很酷。力圖打造我的瓦片地圖,我有這樣的消息:

enter image description here

怎麼辦? 看來,我必須添加一些地方使用dinamyc模板的可能性。我應該創建一個模板並將其添加到我的文件conf logstash? 有人可以給我一些反饋嗎?謝謝 !

回答

1

如果你在爲你的指數Kibana設置看,你需要至少一個字段的類型geo_point展現出來,以便能夠在地圖上得到任何東西。

如果您還沒有geo_point字段,則需要在爲geoip.coordinates字段設置適當的映射後重新爲您的數據建立索引。例如:https://stackoverflow.com/a/42004303/2785358

如果您使用的是相對較新版本的Elasticsearch(2.3或更高版本),那麼對數據進行重新索引相對比較容易。您需要使用正確的映射創建新索引,使用重新索引API將數據複製到新索引,刪除原始索引,然後重新索引回原始名稱。

0

您正在使用geoip過濾錯誤,並試圖經度和緯度轉換爲浮動。擺脫您的mutate過濾器並將geoip過濾器更改爲此。

geoip { 
    source => "ip" 
    fields => ["latitude","longitude"] 
    add_tag => "geoip" 
} 

這將創建適當的字段。和所需的GeoJSON對象。