logstash/conf.d

13-mumble.conf

filter {
  if [type] == "mumble" {
    grok {
      match => { "message" => "<W>%{TIMESTAMP_ISO8601:timestamp}%{SPACE}1%{SPACE}=>%{SPACE}<%{NUMBER:id}:\(-1\)>%{SPACE}New%{SPACE}connection:%{SPACE}%{IP:clientip}:%{BASE10NUM:port}" }
    }
    geoip {
      source => "clientip"
      target => "geoip"
      database => "/etc/logstash/GeoLiteCity.dat"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    }
    mutate {
      convert => [ "[geoip][coordinates]", "float"]
    }
  }
}