grok 添加字段

filter {
    grok {
        match =>[ 
             "message","%{IPORHOST:clientip} [%{HTTPDATE:time}] "%{WORD:verb} %{URIPATHPARAM:request}?.* HTTP/%{NUMBER:httpversion}" - %{NUMBER:http_status_code} %{NUMBER:bytes} "(?

<http_referer>S+)" "(?<http_user_agent>(S+s+)*S+)" (%{BASE16FLOAT:request_time}) (%{IPORHOST:http_x_forwarded_for}|-)", 
             "message" , "%{IPORHOST:clientip} [%{HTTPDATE:time}] "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}" - %{NUMBER:http_status_code} %{NUMBER:bytes} "(?

<http_referer>S+)" "(?<http_user_agent>(S+s+)*S+)" (%{BASE16FLOAT:request_time}) (%{IPORHOST:http_x_forwarded_for}|-)"
             
        ]
    }   
        geoip {
                        source => "http_x_forwarded_for"
                        target => "geoip"
                        database => "/usr/local/logstash-2.3.4/etc/GeoLiteCity.dat"
                        add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
                        add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
                }
                mutate {
                        convert => [ "[geoip][coordinates]", "float"]
                }
     
}



/*******************

zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat geoip.conf
input {stdin {} }

filter {
  geoip {
   source =>"message"
 }
} 


output {
      stdout {
               codec => rubydebug{}
                } 
}


zjtest7-frontend:/usr/local/logstash-2.3.4/config# ../bin/logstash -f geoip.conf
Settings: Default pipeline workers: 1
Pipeline main started
202.101.172.35
{
       "message" => "202.101.172.35",
      "@version" => "1",
    "@timestamp" => "2016-09-11T02:54:11.116Z",
          "host" => "0.0.0.0",
         "geoip" => {
                    "ip" => "202.101.172.35",
         "country_code2" => "CN",
         "country_code3" => "CHN",
          "country_name" => "China",
        "continent_code" => "AS",
              "latitude" => 35.0,
             "longitude" => 105.0,
              "location" => [
            [0] 105.0,
            [1] 35.0
        ]
    }
}


/*******************添加字段
zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat geoip.conf
input {stdin {} }

filter {
  geoip {
   source =>"message"
  add_field => [ "[geoip][scantest]", "%{[geoip][location][0]}" ]
 }
} 


output {
      stdout {
               codec => rubydebug{}
                } 
}

zjtest7-frontend:/usr/local/logstash-2.3.4/config# ../bin/logstash -f geoip.conf
Settings: Default pipeline workers: 1
Pipeline main started
202.101.172.35
{
       "message" => "202.101.172.35",
      "@version" => "1",
    "@timestamp" => "2016-09-11T02:57:07.832Z",
          "host" => "0.0.0.0",
         "geoip" => {
                    "ip" => "202.101.172.35",
         "country_code2" => "CN",
         "country_code3" => "CHN",
          "country_name" => "China",
        "continent_code" => "AS",
              "latitude" => 35.0,
             "longitude" => 105.0,
              "location" => [
            [0] 105.0,
            [1] 35.0
        ],
              "scantest" => 105.0
    }
}