aljaz/cowrie
1
0
Fork 0
mirror of https://github.com/aljazceru/cowrie.git synced 2025-12-17 05:54:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

Remove redundant [geoip][coordinates] field, since we already have [geoip][location] (added by geoip filter itself) (#440)

Browse Source
This commit is contained in:
fe7ch
2017-02-02 13:11:15 +03:00
committed by Michel Oosterhof
parent e2033c36f3
commit 53ccf45c7c
2 changed files with 1 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
doc/elk/README.md
View File

@@ -62,7 +62,6 @@ chown kibana:kibana /var/log/kibana
``` ```
wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz
wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country.mmdb.gz
``` ```
* Place these somewhere in your filesystem and make sure that "logstash" user can read it * Place these somewhere in your filesystem and make sure that "logstash" user can read it
@@ -150,4 +149,4 @@ http://<hostname>:9200/_search?q=cowrie&size=5
* Refer to elastic's documentation about proper configuration of the system for the best elasticsearch's performance * Refer to elastic's documentation about proper configuration of the system for the best elasticsearch's performance
* You may avoid installing nginx for restricting access to the kibana by installing official elastic's plugin called "XPack" (https://www.elastic.co/products/x-pack) * You may avoid installing nginx for restricting access to the kibana by installing official elastic's plugin called "X-Pack" (https://www.elastic.co/products/x-pack)

6
doc/elk/logstash-cowrie.conf
View File

@@ -34,12 +34,6 @@ filter {
source => "src_ip" source => "src_ip"
target => "geoip" target => "geoip"
database => "/opt/logstash/vendor/geoip/GeoLite2-City.dat" database => "/opt/logstash/vendor/geoip/GeoLite2-City.dat"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => [ "[geoip][coordinates]", "float" ]
} }
} }
} }