logstash-filter-geoip
logstash-filter-geoip copied to clipboard
If source is an array iterate through array
Currently the geoip filter takes either only one 1 IP or if its an array takes the first element into the array:
https://github.com/logstash-plugins/logstash-filter-geoip/blob/1d0c9c438ba3d767f7b7041fb3db90336299c062/lib/logstash/filters/geoip.rb#L44
# The field containing the IP address or hostname to map via geoip. If
# this field is an array, only the first value will be used.
config :source, :validate => :string, :required => true
It would be useful if it encounters an array that it iterates through the array and creates something like:
geoip[0] geoip[1] etc..
for each IP address. Or whatever is defined in target.
May be applying a logic similar to the iterate_on
option from the translate plugin would be nice.