zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat geoip.conf input {stdin {} } filter { geoip { source =>"message" add_field => [ "[geoip][scantest]", "%{[geoip][location][0]}" ] } mutate { convert => [ "[geoip][scantest]", "integer"] } } output { stdout { codec => rubydebug{} } } zjtest7-frontend:/usr/local/logstash-2.3.4/config# ../bin/logstash -f geoip.conf Settings: Default pipeline workers: 1 Pipeline main started 115.218.62.240 { "message" => "115.218.62.240", "@version" => "1", "@timestamp" => "2016-09-11T03:56:17.525Z", "host" => "0.0.0.0", "geoip" => { "ip" => "115.218.62.240", "country_code2" => "CN", "country_code3" => "CHN", "country_name" => "China", "continent_code" => "AS", "region_name" => "02", "city_name" => "Wenzhou", "latitude" => 27.99940000000001, "longitude" => 120.66680000000002, "timezone" => "Asia/Shanghai", "real_region_name" => "Zhejiang", "location" => [ [0] 120.66680000000002, [1] 27.99940000000001 ], "scantest" => 120 } }