首页 > 解决方案 > logstash error - database File does not exist or cannot be opened

问题描述

i making map using geoip, elastic stack but i have problem

docker-elk, filebeat

input {
        beats {
                port => 5000
        }
}

filter {
  grok {
    match => { "message" => "%{COMMONAPACHELOG}" }
  }
  date {
    match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
  }
  geoip {
    source => "clientip"
    target => "geoip"
    database => "/home/semicolon/DDYZD/ELK/GeoLite2-City-CSV_20210202/GeoLite2-City-Blocks-IPv4.csv"
  }
}

## Add your filters / logstash plugins configuration here

output {
        elasticsearch {
                hosts => ":9200"
                user => ""
                password => ""
                index => 'logstash-ddyzd-%{+YYYY.MM.dd}'
        }
}

this is my logstash pipeline code, and User and password are filled in

docker-compose up than make error

[2021-02-06T13:20:10,419][ERROR][logstash.filters.geoip   ] Invalid setting for geoip filter plugin:
logstash_1       |
logstash_1       |   filter {
logstash_1       |     geoip {
logstash_1       |       # This setting must be a path
logstash_1       |       # File does not exist or cannot be opened /home/semicolon/DDYZD/ELK/GeoLite2-City-CSV_20210202/GeoLite2-City-Blocks-IPv4.csv
logstash_1       |       database => "/home/semicolon/DDYZD/ELK/GeoLite2-City-CSV_20210202/GeoLite2-City-Blocks-IPv4.csv"
logstash_1       |       ...
logstash_1       |     }
logstash_1       |   }

like this

Database is exist at /home/semicolon/DDYZD/ELK/GeoLite2-City-CSV_20210202/GeoLite2-City-Blocks-IPv4.csv

and i also try mmdb file, but same result

please help me

标签: databaselogstashelastic-stackgeoip

解决方案


推荐阅读