zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat geoip.conf input {stdin {} } filter { geoip { source =>"message" } } output { stdout { codec => ruby } } 183.60.92.253 { "message" => "183.60.92.253", "@version" => "1", "@timestamp" => "2016-08-25T08:37:44.725Z", "host" => "0.0.0.0", "geoip" => { "ip" => "183.60.92.253", "country_code2" => "CN", "country_code3" => "CHN", "country_name" => "China", "continent_code" => "AS", "region_name" => "30", "city_name" => "Guangzhou", "latitude" => 23.11670000000001, "longitude" => 113.25, "timezone" => "Asia/Chongqing", "real_region_name" => "Guangdong", "location" => [ [0] 113.25, [1] 23.11670000000001 ] } } zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat geoip.conf input {stdin {} } filter { geoip { source =>"message" } } output { stdout { codec => json } } zjtest7-frontend:/usr/local/logstash-2.3.4/config# ../bin/logstash -f geoip.conf Settings: Default pipeline workers: 1 Pipeline main started 183.60.92.253 {"message":"183.60.92.253","@version":"1","@timestamp":"2016-08-25T08:43:09.674Z","host":"0.0.0.0","geoip": {"ip":"183.60.92.253","country_code2":"CN","country_code3":"CHN","country_name":"China","continent_code":"AS","region_name":"30","city_name":"Guangzhou","latitude":23.11670000000001,"longitude":113 .25,"timezone":"Asia/Chongqing","real_region_name":"Guangdong","location":[113.25,23.11670000000001]}}