search

ip2location / logstash-filter-ip2location

IP2Location filter plugin for Logstash enables Logstash's users to add geolocation information such as country, state, city, latitude, longitude, ZIP code, time zone, ISP, domain name, connection speed, IDD code, area code, weather station code, weather station name, MNC, MCC, mobile brand, elevation and usage type by IP address.
https://www.ip2location.com
Other
20 stars 5 forks source link

Cache Problem #11

Closed ieth0 closed 6 years ago

ieth0 commented 6 years ago

Description: Using ip2location v1.1.0+, clientip != ip2location.ip_address. ip2location.ip_address is always the same after starting logstash

Steps to reproduce the issue: 1) First installed latest version of ip2location ( 2.0.1 ) on logstash 5.6 and faced the problem. ip2location.ip_address wouldn't change, and it was one repetitive ip. 2) changed use_memory_mapped to true, got some errors, didn't work. 3) upgraded logstash to 6.4.2 same problem. 4) checked the codes and found cache_size which I didn't find on documents. Increase/decrease it, same problem. 5) downgraded to 2.0.0 , same. downgraded to 1.1.0 same, and finally to 1.0.3 and it worked but with horrible performance ( with 5k messages per second ). scaled logstash to 5 instances to make it work.

Since cache is implemented on v1.1.0, I think something is wrong with cache.

Describe the results you received:

client_ip ip2location.ip_address
4.2.2.1 4.2.2.1
4.2.2.2 4.2.2.1
4.2.2.3 4.2.2.1

Describe the results you expect:

client_ip ip2location.ip_address
4.2.2.1 4.2.2.1
4.2.2.2 4.2.2.2
4.2.2.3 4.2.2.3

Config: Added:

   ip2location {
      source => "client_ip"
      database => "/etc/ip2location/ip2location.bin"
      #use_memory_mapped => false
    }

and removed geoip block.

Versions: elasticsearch 5.6.10 logstash 5.6.10 and 6.4.2

ieth0 commented 6 years ago

fixed in #12

salarnasiri commented 5 years ago

i have same problem how can i fix it ?? i didn't understand the solution.

logstash version 7.2.1

ip2location commented 5 years ago

Hi @salarnasiri

The issue is fixed in the latest version. You can run the following command to update the plugin, logstash-plugin update logstash-filter-ip2location

Please make sure the version of logstash-filter-ip2location is updated to v2.0.2

salarnasiri commented 5 years ago

no it's not. if we have source like this [nginx][access][src] the module stop working.

ip2location commented 5 years ago

Hi @salarnasiri

Are you calling the correct field of the source ip? Perhaps, can you send the error message to support@ip2location.com for our investigation?

salarnasiri commented 5 years ago

yes. I will fix it and send you a PR soon. please review and merge it.