ELK7.4- coordinate Map Mapping Nginx user Geographic location
Xiaosheng blog: http://xsboke.blog.51cto.com
-Thank you for your reference. If you have any questions, you are welcome to communicate.
Catalogue
Requirements environment logstash configuration kibana configuration requirements use Geoip to parse the nginx user IP geographic location, and then map the user geographic location visualization environment through kibana's "coordinates map"
This document mainly shows the configuration of logstash filter plugin and kibana. For previous configurations, please refer to: ELK7.4- Quick start for data collection.
Web 172.16.100.251 nignx/filebeat/logstash elasticsearch 172.16.100.252 elasticsearch/kibanaWeb configuration
Add pipelines configuration
Vim / etc/logstash/conf.d/nginx.confinput {beats {port = > 5044} filter {if "nginx_access" in [tags] {grok {match = > {"message" > "% {NUMBER:request_time}\ |% {IPORHOST:access_domain}\ |% {IPORHOST:remote_addr}\ |% {USERNAME:remote_user}\ |\ [% {HTTPDATE:time_local}\]\ |% {NOTSPACE:request_ Method}% {NOTSPACE:request} (?: HTTP/% {NUMBER:http_version})\ |% {NUMBER:status}\ |% {NUMBER:upstream_status}\ |% {NUMBER:upstream_response_time}\ |% {NOTSPACE:upstream_addr}\ |% {NUMBER:body_bytes_sent}\ |% {NOTSPACE:request_body}\ |% {NOTSPACE:http_referer}\ |% {GREEDYDATA:http_user_agent}\ |% {NOTSPACE:http_x_forwarded_ Path}\ |% {NOTSPACE:upstream_cache_status} "}} geoip {source = >" remote_addr "target = >" geoip "# Fields to be sent Default is this add_field = > ["[geoip] [coordinates]", "% {[geoip] [longitude]}"] # get longitude add_field = > ["[geoip] [coordinates]", "% {[geoip] [latitude]}"] # get latitude} mutate {convert = > ["[geoip] [coordinates]" "float"] # modify latitude and longitude to float} output {if "nginx_access" in [tags] {elasticsearch {hosts = > ["172.16.100.252 YYYY.MM.dd 9200"] index = > "logstash-nginx_access-% {+ YYYY.MM.dd}" # use the logstash index to avoid manually specifying geoip as the geo_point type. } elasticsearch configuration
Kibana configuration
By default, kibana uses "Elastic Maps Service" display map module. To use modules from other service providers, you can modify "map.tilemap.url". The following is modified to Amap # map.tilemap.url: 'http://webrd02.is.autonavi.com/appmaptile?lang=zh_cn&size=1&scale=1&style=7&x={x}&y={y}&z={z}'7.4 version of kibana is more compatible with Chinese. Personally, it is recommended to use the default "Elastic Maps Service" display map module of Kibana. You can modify the language of kibana to display Chinese: # i18n.locale: "zh-CN"
Kibana Web configuration
New Visualization-> coordinate Map-> Select logstash Index
Configure according to the following figure and save it.
