GEO IP for intranet network about elastiflow HOT 4 CLOSED

It used to be possible to create your own GeoIP DB for the old Maxmind DB format. However that would require the old version of the GeoIP filter, which isn't compatible with the later versions of Logstash. You should be able to populate the GeoIP fields manually, including the necessary geo_point type location field by using the translate filter (to lookup data) and the mutate filter to set field values. This would have to be a custom addition, which you create for your needs, rather than something provided in ElastiFlow itself.

I am going to leave this open for now, as I might write an article that explains best practices for such customizations.

from elastiflow.

How can the geo-location be linked to IP addresses from the private of the network (10.x.x.x)?

You can have DNS LOC records but does logstash/elastiflow search for them? idk

from elastiflow.

I am going to leave this open for now, as I might write an article that explains best practices for such customizations.

It would be nice! Now it is not very clear in what place and most importantly how to properly implement my code.

from elastiflow.

This would be best solved using the cidr filter. The geoip filter does not support custom dictionaries.

from elastiflow.