updates nginx pipeline w/ less geoip fields

This commit is contained in:
2025-11-07 20:08:25 +01:00
parent 871b42855c
commit f41a31ca71

View File

@@ -9,22 +9,29 @@ filter {
match => [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"] match => [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
overwrite => [ "message" ] overwrite => [ "message" ]
} }
mutate { mutate {
convert => ["response", "integer"] rename => { "extra_fields" => "real_ip" }
convert => ["bytes", "integer"] gsub => [ "real_ip", "\"", "" ] # remove qoutes
gsub => [ "real_ip", " ", "" ] # remove whitespace
# fix
convert => ["http.response.status_code", "integer"]
convert => ["http.response.body.bytes", "integer"]
convert => ["responsetime", "float"] convert => ["responsetime", "float"]
remove_field => ["host.containerized"]
} }
# geoip {
# source => "clientip" geoip {
# add_tag => [ "nginx-geoip" ] source => "real_ip"
# } target => "geoip"
fields => ["city_name", "region_name", "country_name", "region_iso_code", "country_code2", "location"]
}
date { date {
match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ] match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
remove_field => [ "timestamp" ] remove_field => [ "timestamp" ]
} }
# useragent {
# source => "agent"
# }
} }
output { output {
@@ -36,4 +43,3 @@ output {
document_type => "nginx_logs" document_type => "nginx_logs"
} }
} }