Logstash Geolocation not functioning properly - geolocation

Question

My entire system crashes after I change the configuration to add geo location field.
My system runs correctly when my config looks like this:
input {
syslog
{
host => "localhost4"
port => 5140
type => "system"
}
}
filter {
grok { match => { message => [ ".*ipaddr: %{IP:ipaddr}.*" ] }}
grok { match => { message => [ ".*dnsname: %{HOSTNAME:query_name}.*" ] }}
grok { match => { message => [ ".*mal_rank: %{NUMBER:malrank:int}.*" ] }}
grok { match => { message => [ ".*packet_size: %{NUMBER:packetsize:int}.*" ] }}
grok { match => { message => [ ".*source_ip: %{IP:sourceip}.*" ] }}
grok { match => { message => [ ".*dest_ip: %{IP:dest_ip}.*" ] }}
grok { match => { message => [ ".*source_ip: %{IP:src_ip}.*" ] }}
grok { match => { message => [ ".*sport: %{NUMBER:sport:int}.*" ] }}
}
output {
elasticsearch { hosts => ["localhost4:9200"] }
stdout { codec => rubydebug }
}
But when I add the code to my filter
input {
syslog
{
host => "localhost4"
port => 5140
type => "system"
}
}
filter {
grok { match => { message => [ ".*ipaddr: %{IP:ipaddr}.*" ] }}
grok { match => { message => [ ".*dnsname: %{HOSTNAME:query_name}.*" ] }}
grok { match => { message => [ ".*mal_rank: %{NUMBER:malrank:int}.*" ] }}
grok { match => { message => [ ".*packet_size: %{NUMBER:packetsize:int}.*" ] }}
grok { match => { message => [ ".*source_ip: %{IP:sourceip}.*" ] }}
grok { match => { message => [ ".*dest_ip: %{IP:dest_ip}.*" ] }}
grok { match => { message => [ ".*source_ip: %{IP:src_ip}.*" ] }}
grok { match => { message => [ ".*sport: %{NUMBER:sport:int}.*" ] }}
geoip {
source => "ipaddr"
target => "geoip"
add_tag => ["geoip"]
database => "/etc/logstash/GeoLiteCity.dat"
}
}
output {
elasticsearch { hosts => ["localhost4:9200"] }
stdout { codec => rubydebug }
}
I can run the curl command and get the correct output
curl http://localhost:9200/logstash-2016.04.19/_mapping/system/field/geoip.location?pretty
and returned:
{
"logstash-2016.04.19" : {
"mappings" : {
"system" : {
"geoip.location" : {
"full_name" : "geoip.location",
"mapping" : {
"location" : {
"type" : "geo_point"
}
}
}
}
}
}
}
But instead of getting anything, my logstash stops reading from the syslog.
Any suggestions?

Answer 1

I'm not sure what the delay is, but if I let the system wait for about an hour it starts processing logs again. I just wanted to to confirm that this code does function properly.