Rooba
/
cowrie
mirror of https://github.com/cowrie/cowrie.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove redundant [geoip][coordinates] field, since we already have [geoip][location] (added by geoip filter itself) (#440)

This commit is contained in:
fe7ch 2017-02-02 13:11:15 +03:00 committed by Michel Oosterhof
parent e2033c36f3
commit 53ccf45c7c
2 changed files with 1 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
doc/elk/README.md
View File

@ -62,7 +62,6 @@ chown kibana:kibana /var/log/kibana
```
wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz
wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country.mmdb.gz
```
* Place these somewhere in your filesystem and make sure that "logstash" user can read it
@ -150,4 +149,4 @@ http://<hostname>:9200/_search?q=cowrie&size=5
* Refer to elastic's documentation about proper configuration of the system for the best elasticsearch's performance
* You may avoid installing nginx for restricting access to the kibana by installing official elastic's plugin called "XPack" (https://www.elastic.co/products/x-pack)
* You may avoid installing nginx for restricting access to the kibana by installing official elastic's plugin called "X-Pack" (https://www.elastic.co/products/x-pack)

6
doc/elk/logstash-cowrie.conf
View File

@ -34,12 +34,6 @@ filter {
source => "src_ip"
target => "geoip"
database => "/opt/logstash/vendor/geoip/GeoLite2-City.dat"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => [ "[geoip][coordinates]", "float" ]
}
}
}