You should look into using a MultiDecoder, with a cascade strategy of 'all'.
[ProtobufGeoIpMultiDecoder] type = "MultiDecoder" cascade_strategy = "all" log_sub_errors = false subs = [ 'ProtobufDecoder', 'GeoIpDecoder' ] [GeoIpDecoder] type = "GeoIpDecoder" db_file="/etc/geoip/GeoLiteCity.dat" source_ip_field="remote_host" target_field="geoip" -- Robison Jacka / OpsEng / Weebly On Wed, Jan 6, 2016 at 6:21 AM, Ramin Ali Dousti <[email protected]> wrote: > Hi, > > I have an array of heka servers that would parse my application logs and > use TcpOutput with ProtobufEncoder to send the produced Heka Messages to a > centralized heka daemon. The message would have a field that represents an > IP address. On this centralized heka daemon I'd like to do a goe IP lookup > on that field and augment the Heka Message with that info (which ultimately > will be put into elasticsearch. > > Now on the receiving end I have a TcpInput with ProtobufDecoder consuming > the messages sent from that array of heka servers. According to the > documentation there exists a GeoIpDecoder, but it is not clear to me how I > can utilize this decoder for my incoming messages from TcpInput since I can > only mention one decoder and that is already done for ProtobufDecoder. > > Any insight, pointers or suggestion would be greatly appreciated. > > -- > Ramin > > _______________________________________________ > Heka mailing list > [email protected] > https://mail.mozilla.org/listinfo/heka > >
_______________________________________________ Heka mailing list [email protected] https://mail.mozilla.org/listinfo/heka
