Uploaded image for project: 'logstash'
  1. LOGSTASH-1100

GeoIP input doesn't work with IPv6 addresses: crash with GeoIPCityv6.dat

    Details

      Description

      I have configured Logstash with a geoip input, specifying the path to the GeoLiteCityv6.dat file. When I launch Logstash, it crashes with

      {{

      Read config {:level=>:info}
      Start thread {:level=>:info}
      Using beta plugin 'zeromq'. For more information about plugin statuses, see http://logstash.net/docs/1.1.12/plugin-status {:level=>:info}
      Using experimental plugin 'geoip'. This plugin is untested and may change in the future. For more information about plugin statuses, see http://logstash.net/docs/1.1.12/plugin-status {:level=>:warn}
      Deprecated config item "field" set in LogStash::Filters::GeoIP {:name=>"field", :plugin=><LogStash::Filters::GeoIP --->, :level=>:warn}
      Using beta plugin 'file'. For more information about plugin statuses, see http://logstash.net/docs/1.1.12/plugin-status {:level=>:info}
      0mq: bound {:address=>"tcp://t1.prox:2122", :level=>:info}
      Input registered {:plugin=><LogStash::Inputs::ZeroMQ type=>"zmq", address=>["tcp://t1.prox:2122"], format=>"json", message_format=>"Query %

      {id}

      is for %

      {qtype}

      and t=%

      {temp}

      ", mode=>"client", topic=>["dns1"], topology=>"pubsub", tags=>["z1"], charset=>"UTF-8">, :level=>:info}
      Using geoip database {:path=>"/Users/jpm/Zz/logstash/geoip/GeoLiteCityv6.dat", :level=>:info}
      Exception in thread "LogStash::Runner" org.jruby.exceptions.RaiseException: (NameError) uninitialized constant LogStash::Filters::GeoIP::RuntimeException
      at org.jruby.RubyModule.const_missing(org/jruby/RubyModule.java:2677)
      at RUBY.register(file:/Users/jpm/Zz/logstash/logstash-1.1.12-flatjar.jar!/logstash/filters/geoip.rb:79)
      at RUBY.run_with_config(file:/Users/jpm/Zz/logstash/logstash-1.1.12-flatjar.jar!/logstash/agent.rb:472)
      at org.jruby.ext.thread.Mutex.synchronize(org/jruby/ext/thread/Mutex.java:149)
      at RUBY.run_with_config(file:/Users/jpm/Zz/logstash/logstash-1.1.12-flatjar.jar!/logstash/agent.rb:471)
      at org.jruby.RubyArray.each(org/jruby/RubyArray.java:1613)
      at RUBY.run_with_config(file:/Users/jpm/Zz/logstash/logstash-1.1.12-flatjar.jar!/logstash/agent.rb:469)
      at org.jruby.ext.thread.Mutex.synchronize(org/jruby/ext/thread/Mutex.java:149)
      at RUBY.run_with_config(file:/Users/jpm/Zz/logstash/logstash-1.1.12-flatjar.jar!/logstash/agent.rb:426)
      at RUBY.run(file:/Users/jpm/Zz/logstash/logstash-1.1.12-flatjar.jar!/logstash/agent.rb:373)
      at org.jruby.RubyProc.call(org/jruby/RubyProc.java:249)
      at RUBY.initialize(file:/Users/jpm/Zz/logstash/logstash-1.1.12-flatjar.jar!/stud/task.rb:12)

      }}

      If I use the GeoLiteCity.dat file, then IPv6 addresses are (obviously) not found, but Logstash doesn't crash.

      Does this call for two separate database configurations, one for IPv4 and one for IPv6?

        Gliffy Diagrams

          Attachments

            Activity

              People

              • Assignee:
                logstash-dev Logstash Developers (Inactive)
                Reporter:
                jpmens JP Mens
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: