LogstashでIPアドレスから地域情報を出力する

input {
    stdin {
        codec => plain { charset => "SJIS" }
    }
}

filter {
    if [message] =~ /^\s*$/ {
        drop { }
    }

    csv {
        columns => [
            "inp1","inp2","ip"
        ]
        separator => ","
        skip_empty_columns => true
    }

    geoip {
        source => ["ip"]
    }

    if ![geoip][country_name] {
        mutate {
            add_field => { "[geoip][country_name]" => "" }
        }
    }

    if ![geoip][region_name] {
        mutate {
            add_field => { "[geoip][region_name]" => "" }
        }
    }
}

output {
#    stdout {codec => rubydebug}

    file {
        codec => line { format => "%{inp1},%{inp2},%{ip},%{[geoip][country_name]},%{[geoip][region_name]}
"}
        path => "out_utf8.csv"
    }
}