Right, MultiDecoder is what you want. Also note that the release binaries don't include the GeoIPDecoder. You'll want to build from source with GeoIP.h in your include path, and make sure you have the libGeoIP library on the target machines.
-r On 01/06/2016 09:47 AM, Robbie Jacka wrote:
You should look into using a MultiDecoder, with a cascade strategy of 'all'. [ProtobufGeoIpMultiDecoder] type = "MultiDecoder" cascade_strategy = "all" log_sub_errors = false subs = [ 'ProtobufDecoder', 'GeoIpDecoder' ] [GeoIpDecoder] type = "GeoIpDecoder" db_file="/etc/geoip/GeoLiteCity.dat" source_ip_field="remote_host" target_field="geoip" -- Robison Jacka / OpsEng / Weebly On Wed, Jan 6, 2016 at 6:21 AM, Ramin Ali Dousti <[email protected] <mailto:[email protected]>> wrote: Hi, I have an array of heka servers that would parse my application logs and use TcpOutput with ProtobufEncoder to send the produced Heka Messages to a centralized heka daemon. The message would have a field that represents an IP address. On this centralized heka daemon I'd like to do a goe IP lookup on that field and augment the Heka Message with that info (which ultimately will be put into elasticsearch. Now on the receiving end I have a TcpInput with ProtobufDecoder consuming the messages sent from that array of heka servers. According to the documentation there exists a GeoIpDecoder, but it is not clear to me how I can utilize this decoder for my incoming messages from TcpInput since I can only mention one decoder and that is already done for ProtobufDecoder. Any insight, pointers or suggestion would be greatly appreciated. -- Ramin _______________________________________________ Heka mailing list [email protected] <mailto:[email protected]> https://mail.mozilla.org/listinfo/heka _______________________________________________ Heka mailing list [email protected] https://mail.mozilla.org/listinfo/heka
_______________________________________________ Heka mailing list [email protected] https://mail.mozilla.org/listinfo/heka
