Fluentd: apache.log | fluent-plugin-geoip

td-agent.conf

<source>
  type tail
  format apache
  path /var/log/httpd/access_log
  pos_file /var/log/td-agent/access_log.pos
  tag geo.apache.log
</source>

<match geo.apache.log>
  type geoip
  geoip_lookup_key host
  <record>
    country ${country_code['host']}
    coordinate [${longitude['host']},${latitude['host']}]
  </record>
  remove_tag_prefix geo.
</match>

<match apache.log>
  type elasticsearch
  host localhost
  port 9200
  index_name apache
  type_name apache_log
  include_tag_key true
  tag_key @log_name
  logstash_format true
  time_format %Y-%m-%d %H:%M:%S
</match>

sudo yum install geoip-devel —enablerepo=epel
sudo /usr/lib64/fluent/ruby/bin/fluent-gem install fluent-plugin-geoip