Overview

GeoIP was COMPLETELY NUTS to set up, at least for me it was impossible with logstash, so I used directly a beat agent to set it directly to the elasticsearch. For some reason, my grok pattern wasn't recognized…even tough according the grok debugger WAS WORKING!!! :) So I used the traefik module of Filebeats as follows:

Install Filebeats

The installation of file beats is rather simple, just download the version (or use yum repo) and install it:

After the installation we have to configure 2 things:

Configuration

Modules

As I said, I was not able to set up logstash for my httpd access log, even though my GROK WAS CORRECT !!! :) So I just used the already done module by filebeat: traefik

Configuration

Modules

I have enabled 2 modules:

Modules Config

Done

After that the filebeat, should start sending the necessary data to the elasticsearch and from there you can check it via Kibana :)