Export GeoIP Information
editExport GeoIP Information
editYou can use Packetbeat along with the ingest geoIP processor plugin in Elasticsearch to export geographic location information about source IPs for incoming HTTP requests. Then you can use this info to visualize the location of your clients on a map in Kibana.
The geoIP processor plugin adds information about the geographical location of IP addresses, based on data from the Maxmind GeoLite2 City Database. Because the plugin uses a geoIP database that’s installed on Elasticsearch, you don’t need to install a geoIP database on the machines running Beats.
If your use case involves using Logstash, you can use the GeoIP filter available in Logstash instead of using the ingest plugin. However, using the ingest plugin is the simplest approach when you don’t require the additional processing power of Logstash.
Configuring the ingest geoIP processor plugin
editTo configure Packetbeat and the ingest geoIP processor plugin:
- Install the ingest geoIP processor plugin. After installing the plugin, remember to restart the node.
-
Define an ingest node pipeline that uses a
geoip
processor to add location info to the event. For example, you can use the Console in Kibana to create the following pipeline:PUT _ingest/pipeline/geoip-info { "description": "Add geoip info", "processors": [ { "geoip": { "field": "client_ip", "target_field": "client_geoip", "properties": ["location"], "ignore_failure": true } } ] }
This pipeline adds a
client_geoip.location
field of typegeo_point
to the event. The ID of the pipeline isgeoip-info
.client_ip
is the output field in Packetbeat that contains the IP address of the client. You setignore_failure
totrue
so that the pipeline will continue processing events when it encounters an event that doesn’t have aclient_ip
field.See Using the Geoip Processor in a Pipeline for more options.
-
In the Packetbeat config file, configure the Elasticsearch output to use the pipeline. Specify the pipeline ID in the
pipeline
option underoutput.elasticsearch
. For example:output.elasticsearch: hosts: ["localhost:9200"] pipeline: geoip-info
-
Run Packetbeat, passing in the configuration file that you updated earlier.
sudo ./packetbeat -e -c packetbeat.yml
The event that’s sent to Elasticsearch should now include a
client_geoip.location
field.
Visualizing the location of your Packetbeat clients
editTo visualize the location of your Packetbeat clients, you can either
set up the example Kibana dashboards (if
you haven’t already), or create a new coordinate map
in Kibana and use the client_geoip.location
field as the Geohash.
If the map in the dashboard reports "no results found", and you don’t see
client_geoip.location
in the list of available Geohash fields, try refreshing
the field list in Kibana. On the Management tab, select the packetbeat-*
index pattern, and refresh the field list to pick up any fields that were added
by the ingest geoIP processor.