{"id":527,"date":"2018-01-15T22:29:00","date_gmt":"2018-01-15T13:29:00","guid":{"rendered":"https:\/\/wp.zassoul.com\/?p=527"},"modified":"2018-01-15T22:29:00","modified_gmt":"2018-01-15T13:29:00","slug":"cisco%e3%81%aeappfw%e3%81%ae%e3%83%ad%e3%82%b0%e3%82%92filebeat%e2%86%92logstash%e2%86%92elasticsearch%e3%81%8b%e3%82%89%e3%81%aekibana%e3%81%a7map%e8%a1%a8%e7%a4%ba%e3%81%95%e3%81%9b%e3%82%8b","status":"publish","type":"post","link":"https:\/\/wp.zassoul.com\/?p=527","title":{"rendered":"Cisco\u306eAPPFW\u306e\u30ed\u30b0\u3092filebeat\u2192logstash\u2192elasticsearch\u304b\u3089\u306ekibana\u3067Map\u8868\u793a\u3055\u305b\u308b"},"content":{"rendered":"

\u6628\u5e74\u304b\u3089\u30c0\u30e9\u30c0\u30e9\u3068\u5ea7\u5b66\u306b\u53d6\u308a\u7d44\u3093\u3067\u304d\u305f\u3082\u306e\u304c\u5e74\u3092\u8d85\u3048\u3066\u3088\u3046\u3084\u304f\u5f62\u306b\u306a\u3063\u305f\u306e\u3067\u30e1\u30e2\u3002
\u3082\u3068\u3082\u3068Splunk\u306b\u5909\u308f\u308b\u5927\u4f53\u624b\u6bb5\u3068\u3057\u3066\u4f55\u304b\u306a\u3044\u304b\u306a\u30fc\u3068\u63a2\u3057\u3066\u3044\u305f\u3068\u3053\u308d, ELK\u3067\u304a\u8a66\u3057\u3068\u3044\u3046\u8a66\u307f\u3060\u3063\u305f\u3051\u3069, \u8af8\u3005\u306e\u4e8b\u60c5(\u5f8c\u3067\u3084\u308b\u3084\u308b\u8a50\u6b3a)\u3067\u3053\u3093\u306a\u306b\u3082\u6642\u9593\u304c\u304b\u304b\u3063\u305f\u3002<\/p>\n

\u5168\u4f53\u50cf<\/h4>\n

1. Cisco\u304b\u3089Syslog\u3092\u98db\u3070\u3057, Rsyslog\u3067\u53d7\u3051\u53d6\u308b\u3002
2. Filebeat\u3067\u8a72\u5f53\u30d5\u30a1\u30a4\u30eb\u3092Logstash\u3078\u9001\u308b\u3002
3. Logstash\u3067\u30d1\u30fc\u30b9\u3057\u3066Elasticsearch\u3078\u9001\u308b\u3002
4. Kibana\u3067\u8868\u793a\u3002<\/p>\n\n\n\n\n
<\/a><\/td>\n<\/tr>\n
\u5168\u4f53\u50cf<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u30aa\u30fc\u30eb\u30a4\u30f3\u30ef\u30f3\u69cb\u6210\u3068\u3057\u305f\u3002<\/p>\n

Filebeat\u304b\u3089Elasticsearch\u3078\u76f4\u63a5\u3068\u3044\u3046\u65b9\u6cd5\u3082\u3042\u308b\u3088\u3046\u3060\u3051\u3069, \u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u4f5c\u6210\u5468\u308a\u3067\u3088\u304f\u308f\u304b\u3089\u306a\u3044\u3053\u3068\u306b\u9665\u308a\u305d\u3046\u3060\u304b\u3089, Web\u3067\u3088\u304f\u898b\u308bfluentd+logstash\u69cb\u6210\u306b\u7fd2\u3063\u305f\u3002<\/div>\n
\u306a\u304a, \u6709\u511f\u306eX-pack\u306f\u4f7f\u308f\u306a\u3044\u3002<\/div>\n
\n

\u4e00\u9023\u306e\u6d41\u308c<\/h4>\n
1. \u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u4f5c\u6210, \u4e8b\u524d\u6e96\u5099
2. \u5404\u7a2e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u30fb\u8a2d\u5b9a
3. \u8a73\u7d30\u8a2d\u5b9a
4. \u52d5\u4f5c\u78ba\u8a8d<\/div>\n
<\/div>\n

1. \u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u4f5c\u6210, \u4e8b\u524d\u6e96\u5099<\/h3>\n
\u306f\u3058\u3081\u306bELK\u3092\u7acb\u3066\u308b\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u3092\u6e96\u5099\u3059\u308b\u3002<\/div>\n
\u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u4f5c\u6210\u306bJava\u3092\u4f7f\u3046\u3068\u3044\u3046\u3053\u3068\u3067, \u3053\u306eJava\u304c\u30ea\u30bd\u30fc\u30b9\u3092\u7d50\u69cb\u6301\u3063\u3066\u3044\u304f\u306e\u3067\u30ea\u30bd\u30fc\u30b9\u306f\u591a\u3081\u306b\u5272\u308a\u5f53\u3066\u305f\u3002CentOS7\u3067vcpu: 4 mem: 12GB disk: 60GB\u3002<\/div>\n
$ openstack flavor create --ram 12288 --disk 60 --vcpus 4 elastic-flavor
$ openstack server create --flavor elastic-flavor --image CentOS7 --key-name elastic-key elastic
<\/pre>\n
\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u304c\u3067\u304d\u305f\u3089rsyslog\u306e\u8a2d\u5b9a\u3002(\u203bflorting IP\u306e\u8a2d\u5b9a\u306f\u7701\u7565)
<Syslog\u65b9\u91dd>
– Cisco\u5074\u306ffacility local3\u3067\u30b5\u30fc\u30d0\u3078\u6e21\u3059\u3002
– Local3\u3067\u53d7\u4fe1\u3057\u305f\u30ed\u30b0\u306f \/var\/log\/rsyslog\/ \u914d\u4e0b\u306b\u201dhostname.log”\u3067\u4f5c\u6210\u3055\u305b\u308b\u3002<\/p>\n
@Cisco <\/p>\n
logging facility local3
<\/pre>\n
vi \/etc\/rsyslog.conf <\/p>\n
$template DynFile,\"\/var\/log\/rsyslog\/%HOSTNAME%.log
local3.*        -?DynFile

*.info;mail.none;authpriv.none;cron.none;local3.none                \/var\/log\/messages
<\/pre>\n
\u7d9a\u3044\u3066JDK\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3002<\/p>\n
# yum install java-1.8.0-openjdk.x86_64 java-1.8.0-openjdk-debug.x86_64 java-1.8.0-openjdk-devel.x86_64
<\/pre>\n<\/div>\n
\u30aa\u30fc\u30eb\u30a4\u30f3\u30ef\u30f3\u69cb\u6210\u3060\u3051\u3069, IP\u6307\u5b9a\u3067\u69cb\u6210\u3059\u308b\u306e\u3068Cisco\u306e\u540d\u524d\u89e3\u6c7a\u5fc5\u8981\u306a\u306e\u3067hosts\u30d5\u30a1\u30a4\u30eb\u3092\u7de8\u96c6\u3059\u308b\u3002
\/etc\/hosts \u7de8\u96c6<\/p>\n
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

172.16.10.50    elastic
192.168.10.1    local-c841m
<\/pre>\n
<\/p>\n
2. \u5404\u7a2e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u30fb\u8a2d\u5b9a<\/h4>\n
\u30aa\u30d5\u30a3\u30b7\u30e3\u30eb\u306e\u30aa\u30f3\u30e9\u30a4\u30f3\u30de\u30cb\u30e5\u30a2\u30eb\u3092\u53c2\u8003\u306b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3067\u304d\u308b\u3002
Elasticsearch\u624b\u9806
https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/6.1\/rpm.html<\/a>
Kibana\u624b\u9806
https:\/\/www.elastic.co\/guide\/en\/kibana\/6.1\/rpm.html<\/a>
Logstash\u624b\u9806
https:\/\/www.elastic.co\/guide\/en\/logstash\/6.1\/installing-logstash.html<\/a>
Filebeat\u624b\u9806
https:\/\/www.elastic.co\/guide\/en\/beats\/filebeat\/6.1\/filebeat-installation.html<\/a>

<\/b>2.1 \u30ea\u30dd\u30b8\u30c8\u30ea\u767b\u9332<\/b><\/p>\n
rpm --import https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch
<\/pre>\n
\/etc\/yum.repos.d\/elasticsearch.repo \u4f5c\u6210<\/p>\n
[elasticsearch-6.x]
name=Elasticsearch repository for 6.x packages
baseurl=https:\/\/artifacts.elastic.co\/packages\/6.x\/yum
gpgcheck=1
gpgkey=https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
<\/pre>\n

<\/b>2.2 \u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/b><\/p>\n
yum install elasticsearch kibana logstash
wget https:\/\/artifacts.elastic.co\/downloads\/beats\/filebeat\/filebeat-6.1.1-x86_64.rpm
yum install .\/filebeat-6.1.1-x86_64.rpm
<\/pre>\n
2.3 Elasticsearch\u8a2d\u5b9a<\/b>
\u3068\u308a\u3042\u3048\u305a\u52d5\u4f5c\u78ba\u8a8d\u307e\u3067\u3053\u304e\u3064\u3051\u308b\u305f\u3081, \u57fa\u672c\u7684\u306a\u8a2d\u5b9a\u306e\u307f\u3092\u5b9f\u65bd\u3002(Cluster.name\u3084network.host\u306f\u6c17\u5206\u3067\u5909\u3048\u305f)
\/etc\/elasticsearch\/elasticsearch.yml<\/p>\n
cluster.name: elastichome
node.name: elastic
path.data: \/var\/lib\/elasticsearch
path.logs: \/var\/log\/elasticsearch
network.host: 0.0.0.0
http.port: 9200<\/pre>\n
\u8d77\u52d5\u8a2d\u5b9a\u3002<\/p>\n
systemctl enable elasticsearch
systemctl start elasticsearch
<\/pre>\n
2.4 Logstash\u8a2d\u5b9a<\/b>
filebeat\u7528\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u306f\u5f8c\u306b\u3057\u3066\u4e00\u901a\u308a\u8a2d\u5b9a\u3092\u6e08\u307e\u3059\u3002
(\u30ed\u30b0\u8aad\u307f\u8fbc\u307e\u306a\u3044\u306a\u30fc\u7b49\u3046\u307e\u304f\u3044\u304b\u306a\u3044\u6642\u306f\u3053\u3053\u3067\u81ea\u52d5\u8aad\u307f\u8fbc\u307f\u8a2d\u5b9aON\u306b\u3057\u3066log\u30ec\u30d9\u30eb\u3092\u9069\u5b9c\u5909\u66f4\u3059\u308b\u3068\u3088\u3044\u3002)<\/p>\n
path.data: \/var\/lib\/logstash
path.config: \/etc\/logstash\/conf.d\/*.conf
config.reload.automatic: true
config.reload.interval: 5s
log.level: info
path.logs: \/var\/log\/logstash
<\/pre>\n
\u8d77\u52d5\u8a2d\u5b9a\u3002<\/p>\n
systemctl enable logstash
systemctl start logstash<\/pre>\n
2.5 Kibana\u8a2d\u5b9a<\/b>
\u3053\u3053\u3082\u307b\u307c\u57fa\u672c\u7684\u306a\u8a2d\u5b9a\u306e\u307f\u3002
\/etc\/kibana\/kibana.yml<\/p>\n
server.port: 5601
server.host: \"172.16.10.50\"
server.name: \"elastic\"
elasticsearch.url: \"http:\/\/172.16.10.50:9200\"
elasticsearch.username: \"kibana\"
elasticsearch.password: \"kibanapassword\"
logging.dest: \/var\/log\/kibana\/kibana.log
<\/pre>\n
\u8d77\u52d5\u8a2d\u5b9a\u3002<\/p>\n
systemctl enable kibana
systemctl start kibana<\/pre>\n
2.6 Filebeat\u8a2d\u5b9a<\/b>
\u76e3\u8996\u5bfe\u8c61\u306e\u30ed\u30b0\u6307\u5b9a\u3068\u51fa\u529b\u5148\u3092logstash\u306b\u3059\u308b\u8a2d\u5b9a\u3092\u5165\u308c\u308b\u3002
logstash\u3067\u306e\u30d5\u30a3\u30eb\u30bf\u6761\u4ef6\u3067\u5229\u7528\u3059\u308btag\u306e\u8a2d\u5b9a\u3082\u5165\u308c\u308b\u3002<\/p>\n
filebeat.prospectors:
- type: log
  paths:
    - \/var\/log\/rsyslog\/*.log
  fields:
    log_type : ciscolog
  fields_under_root: true
filebeat.config.modules:
  path: ${path.config}\/modules.d\/*.yml
  reload.enabled: true
  reload.period: 10s
  index.number_of_shards: 3
  index.codec: best_compression
  _source.enabled: false
setup.dashboards.enabled: false
output.logstash:
  hosts: [\"172.16.10.50:5044\"]
  index: \"filebeat\"
  username: \"logstash_internal\"
  password: \"logstashpassword\"
logging.level: debug
<\/pre>\n
\u8d77\u52d5\u8a2d\u5b9a\u3002<\/p>\n
systemctl enable filebeat
systemctl start filebeat<\/pre>\n
<\/div>\n
3 \u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3068\u304b\u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u3068\u304b\u8a2d\u5b9a<\/h4>\n
3.1 \u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u4f5c\u6210<\/b>
Filebeat\u7528\u306elogstash\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092 \/etc\/logstash\/conf.d\/beat.conf \u3068\u3057\u3066\u4f5c\u6210\u3059\u308b\u3002<\/p>\n
input {
  beats {
    port => 5044
  }
}
filter {
  if [log_type] == \"ciscolog\" {
    grok {
      match => {
        \"message\" => \"%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:log_host} %{NUMBER:unixtimestamp}: %{SYSLOGTIMESTAMP:ciscotimestamp} %{WORD:timezone}: %{GREEDYDATA:facility}: %{DATA:application} %{GREEDYDATA:msg_1} -  %{WORD:protocol} %{WORD:msg_2} %{IP:src_ip}:%{NUMBER:src_port} %{IP:dst_ip}:%{NUMBER:dst_port} %{GREEDYDATA:msg_3}\"
      }
    }
    geoip {
      source => \"dst_ip\"
    }
    mutate {
      convert => {
        \"src_port\" => \"integer\"
        \"dst_port\" => \"integer\"
      }
    }
  }
}
output {
  elasticsearch {
    hosts => [ \"http:\/\/172.16.10.50:9200\" ]
    index => \"myfilebeat-%{+YYYY.MM}\"
  }
}
<\/pre>\n
\u203b\u88dc\u8db3\u8aac\u660e<\/b>
7\u884c\u76ee:   if [log_type] == “ciscolog” {<\/span><\/span><\/p>\n
filebeat\u306e\u8a2d\u5b9a\u3067 \/var\/log\/rsyslog\/*.log \u306b\u5bfe\u3057\u3066ciscolog\u3068\u3044\u3046log_type\u3068\u3044\u3046\u30d5\u30a3\u30fc\u30eb\u30c9\u3092\u4ed8\u4e0e\u3057\u305f\u306e\u3067, \u3053\u3053\u3067\u6761\u4ef6\u30de\u30c3\u30c1\u30f3\u30b0\u3055\u305b\u3066\u3044\u308b\u3002<\/div>\n
\u4ed6\u306b\u3082\u30ed\u30b0\u3092\u6355\u6349\u3059\u308b\u5834\u5408\u306f\u3053\u306e\u3042\u305f\u308a\u3067\u9069\u5b9c\u30d5\u30fc\u30eb\u30c9\u3092\u8ffd\u52a0\u3057\u3066\u51e6\u7406\u3092\u5909\u3048\u308b\u76ee\u7684\u3002<\/div>\n
\u3053\u3053\u3067\u306f\u7701\u7565\u3057\u3066\u3044\u308b\u3051\u3069, audit.log\u7b49\u3082\u5bfe\u8c61\u3068\u3057\u3066\u3044\u305f\u306e\u3067\u3053\u306e\u8a2d\u5b9a\u5165\u308c\u305f\u3002<\/div>\n
10\u884c\u76ee:  “message” => “%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:log_host} %{NUMBER:unixtimestamp}: %{SYSLOGTIMESTAMP:ciscotimestamp} %{WORD:timezone}: %{GREEDYDATA:facility}: %{DATA:application} %{GREEDYDATA:msg_1} –  %{WORD:protocol} %{WORD:msg_2} %{IP:src_ip}:%{NUMBER:src_port} %{IP:dst_ip}:%{NUMBER:dst_port} %{GREEDYDATA:msg_3}”<\/span><\/span>
Cisco\u30eb\u30fc\u30bf\u306e\u30be\u30fc\u30f3\u30d9\u30fc\u30b9\u306eFW\u30ed\u30b0\u30d5\u30a9\u30fc\u30de\u30c3\u30c8\u3092\u898b\u306a\u304c\u3089\u30d1\u30fc\u30b7\u30f3\u30b0\u3057\u305f\u3044\u7b87\u6240\u3092\u5207\u308a\u51fa\u305b\u308b\u3088\u3046\u306b\u8a18\u8ff0\u3059\u308b\u3002
grok\u30d5\u30a3\u30eb\u30bf\u304c\u826f\u304f\u5206\u304b\u3089\u306a\u3044\u3068\u304d\u306f\u3053\u3053(Grok Debugger)<\/a>\u3092\u53c2\u8003\u306b\u30c8\u30e9\u30a4\u30a2\u30f3\u30c9\u30a8\u30e9\u30fc\u3067\u304c\u3093\u3070\u308b\u3002GREEDYDATA(*\u3068\u540c\u7fa9)\u3092\u4f7f\u3063\u3066\u5c11\u3057\u305a\u3064\u7d30\u5206\u5316\u3057\u3066\u3044\u304f\u306e\u304c\u304a\u3059\u3059\u3081\u3002
14\u884c\u76ee:  source => “dst_ip”<\/span><\/span>
geoip\u30d5\u30a3\u30eb\u30bf\u3067\u5bfe\u8c61\u3068\u306a\u308bIP\u30a2\u30c9\u30ec\u30b9\u3092\u6307\u5b9a\u3059\u308b\u3002
\u4eca\u56de\u306f\u30ed\u30b0\u304b\u3089\u901a\u4fe1\u5148\u304c\u3069\u3053\u304b\u5730\u56f3\u306b\u30de\u30c3\u30d4\u30f3\u30b0\u3059\u308b\u3053\u3068\u3092\u8003\u3048\u3066\u3044\u308b\u306e\u3067, \u30ed\u30b0\u5185\u306edst_ip(\u901a\u4fe1\u5148IP\u30a2\u30c9\u30ec\u30b9)\u3092\u6307\u5b9a\u3057\u305f\u3002
16\u884c\uff5e21\u884c: mutate\u306e\u884c<\/span><\/span>
\u3053\u3053\u306f\u5b9f\u969b\u306b\u30d1\u30fc\u30b9\u3057\u305f\u3089\u306a\u305c\u304btype\u304ctext\u306b\u306a\u3063\u3066\u3044\u305f\u306e\u3067\u5165\u308c\u305f\u3002\u6c17\u306b\u306a\u3063\u305f\u306e\u3067type\u3092\u30b3\u30f3\u30d0\u30fc\u30c8\u3059\u308b\u8a2d\u5b9a\u3092\u8ffd\u52a0\u3002\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u3042\u305f\u308a\u3092\u3057\u3063\u304b\u308a\u7406\u89e3\u3059\u308c\u3070\u3053\u3093\u306a\u3053\u3068\u3057\u306a\u304f\u3066\u3082\u3088\u3044\u306e\u304b\u3082\u3057\u308c\u306a\u3044\u3002
27\u884c\u76ee:  index => “myfilebeat-%{+YYYY.MM}”<\/span><\/span>
elasitcsearch\u3078\u51fa\u529b\u3059\u308b\u969b\u306b\u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u3092\u8ffd\u52a0\u3059\u308b\u3002<\/p>\n
3.2 \u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u4f5c\u6210<\/b>
\u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u306fKibana\u306b\u30ed\u30b0\u30a4\u30f3\u3057, \u300cManagement \u2192 Index Patterns\u300d\u3067\u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u3092\u4f5c\u6210\u3059\u308b\u3002<\/p>\n\n\n\n\n
<\/a><\/td>\n<\/tr>\n
\u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u4f5c\u6210\u753b\u9762<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\u3053\u308c\u3067\u3044\u3051\u308b\u304b\uff01\u3068\u601d\u3063\u305f\u3051\u3069\u5b9f\u969b\u306b\u30de\u30c3\u30d7\u4f5c\u6210\u3092\u3084\u3063\u3066\u307f\u308b\u3068, “kibana\u306eGeo Coordinates\u30de\u30c3\u30d7\u3067\u53c2\u7167\u3055\u308c\u308bgeo_point\u3068\u306a\u308b\u30bf\u30a4\u30d7\u304c\u7121\u3044”\u3068\u306a\u3063\u3066\u4f5c\u6210\u3067\u304d\u306a\u3044\u3002<\/p>\n
\u30c7\u30d5\u30a9\u30eb\u30c8\u306efilebeat\u306e\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u3092\u5143\u306b, \u65b0\u305f\u306b\u4f5c\u6210\u3059\u308b\u3002
<\u624b\u9806>
Kibana\u4e0a\u306eDevTools\u306b\u300cGET _template\/filebeat-*\u300d\u3068\u5165\u308c, \u51fa\u529b\u7d50\u679c\u3092\u7de8\u96c6\u3057\u3066PUT\u3059\u308b\u3002
1. \u5143\u3068\u306a\u308b\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u3092\u5143\u306b\u65b0\u3057\u3044\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u3092\u4f5c\u6210\u3059\u308b\u3002<\/p>\n
{
  \"filebeat<\/b>\": {
    \"order\": 1,
    \"index_patterns\": [
      \"myfilebeat-*<\/b>\"
    ],

\uff5e\u4e2d\u7565\uff5e
              }
            }
          },
\"geoip\": {
            \"properties\": {
              \"continent_name\": {
                \"type\": \"keyword\",
                \"ignore_above\": 1024
              },
              \"country_iso_code\": {
                \"type\": \"keyword\",
                \"ignore_above\": 1024
              },
              \"location\": {
                \"type\": \"geo_point\"
              },
              \"region_name\": {
                \"type\": \"keyword\",
                \"ignore_above\": 1024
              },
              \"city_name\": {
                \"type\": \"keyword\",
                \"ignore_above\": 1024
              }
            }
          }<\/b>
        }
      }
    },
    \"aliases\": {}
  }
}
<\/pre>\n
2. \u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u3092PUT\u3059\u308b\u3002
1\u306e\u5185\u5bb9\u3092DevTools\u3067PUT\u3059\u308b\u3002<\/p>\n
PUT _template\/filebeat
\u203b \u3053\u3053\u306b1\u306e\u5185\u5bb9\u3092\u5165\u308c\u308b
<\/pre>\n
<\/p>\n
4. \u78ba\u8a8d<\/h4>\n
\u3053\u3053\u307e\u3067\u6765\u308c\u3070Kibana\u4e0a\u3067\u6b21\u306e\u3088\u3046\u306b\u8868\u793a\u3055\u308c\u308b\u306f\u305a\u3002<\/p>\n
<\/div>\n
<\/p>\n\n\n\n\n
<\/a><\/td>\n<\/tr>\n
\u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u304c\u4f5c\u6210\u3055\u308c\u3066\u3044\u308b<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n\n
<\/a><\/td>\n<\/tr>\n
geoip.location\u3068\u3044\u3046\u30d5\u30a3\u30fc\u30eb\u30c9\u304cgeo_point\u30bf\u30a4\u30d7\u3067\u4f5c\u6210\u3055\u308c\u3066\u3044\u308b<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Map\u4f5c\u6210\u306f<\/p>\n
    \n
  1. Visualize \u2192 \u300c+\u300d\u65b0\u898f\u4f5c\u6210 \u2192 Maps\u306eCoordinate Map<\/li>\n
  2. myfilebeat-* \u3092\u9078\u629e<\/li>\n
  3. Buckets\u3067\u300cGeoCoodinate\u300d\u3092\u9078\u629e<\/li>\n
  4. Aggregation\u3067\u300cGeohash\u300d\u3092\u9078\u629e<\/li>\n
  5. Field\u3067\u300cgeoip.location\u300d\u3092\u9078\u629e<\/li>\n<\/ol>\n
    \u3067\u5b8c\u4e86\u3002<\/p>\n
    \u6b21\u306e\u3088\u3046\u306aMap\u304c\u8868\u793a\u3055\u308c\u308b\u3002<\/p>\n\n\n\n\n
    <\/a><\/td>\n<\/tr>\n
    Map\u8868\u793a\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
    Splunk\u306e\u307b\u3046\u304c\u5927\u5206\u697d\u306bMap\u4f5c\u6210\u306f\u3067\u304d\u308b\u3051\u3069SPL\u3092\u899a\u3048\u308b\u306e\u3068\u6bd4\u8f03\u3059\u308b\u3068, \u307e\u3041\u3069\u3063\u3053\u3044\u3069\u3063\u3053\u3044\u304b\u306a\u3002<\/p>\n
    \u3068\u308a\u3042\u3048\u305a\u306e\u52d5\u4f5c\u78ba\u8a8d\u304c\u3067\u304d\u305f\u3002
    \u3053\u308c\u304b\u3089\u306f\u7d30\u304b\u304f\u5206\u6790\u30fb\u305d\u306e\u4ed6\u30c7\u30fc\u30bf\u306e\u53ef\u8996\u5316\u3092\u76ee\u6a19\u3068\u3057\u3066\u691c\u8a3c\u3059\u3059\u3081\u308b\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
    \u6628\u5e74\u304b\u3089\u30c0\u30e9\u30c0\u30e9\u3068\u5ea7\u5b66\u306b\u53d6\u308a\u7d44\u3093\u3067\u304d\u305f\u3082\u306e\u304c\u5e74\u3092\u8d85\u3048\u3066\u3088\u3046\u3084\u304f\u5f62\u306b\u306a\u3063\u305f\u306e\u3067\u30e1\u30e2\u3002\u3082\u3068\u3082\u3068Splunk\u306b\u5909\u308f\u308b\u5927\u4f53\u624b\u6bb5\u3068\u3057\u3066\u4f55\u304b\u306a\u3044\u304b\u306a\u30fc\u3068\u63a2\u3057\u3066\u3044\u305f\u3068\u3053\u308d, ELK\u3067\u304a\u8a66\u3057\u3068\u3044\u3046\u8a66\u307f\u3060\u3063\u305f\u3051\u3069, \u8af8\u3005\u306e\u4e8b\u60c5(\u5f8c\u3067\u3084\u308b\u3084\u2026 \u7d9a\u304d\u3092\u8aad\u3080 »<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,51,57,6,55,56,8],"tags":[],"class_list":["post-527","post","type-post","status-publish","format-standard","hentry","category-cisco","category-elasticsearch","category-filebeat","category-it","category-kibana","category-logstash","category-8"],"_links":{"self":[{"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/posts\/527","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=527"}],"version-history":[{"count":0,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/posts\/527\/revisions"}],"wp:attachment":[{"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=527"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=527"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=527"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}