add back in postfix geoip processing

2 years ago · 48e360c825
parent 5c596e54cc
commit 48e360c825
2 changed files with 14 additions and 3 deletions
--- a/10
+++ b/10
@ -17,6 +17,10 @@ t/manifest.t
 t/pod-coverage.t
 t/pod.t
 bin/essearcher
-logstash/postfix/50-filter-postfix.conf
-logstash/postfix/README.md
-logstash/postfix/postfix.grok
+logstash/patterns.d/postfix.grok
+logstash/conf.d/50-filter-postfix.conf
+logstash/conf.d/syslog.conf
+logstash/conf.d/rsyslog.conf
+logstash/conf.d/beats.conf
+logstash/conf.d/51-filter-postfix-aggregate.conf.off
+logstash/README.md
--- a/logstash/conf.d/50-filter-postfix.conf
+++ b/logstash/conf.d/50-filter-postfix.conf
@ -262,5 +262,12 @@ filter {
            "postfix_postscreen_violation_time", "float"
        ]
    }
+
+    # add geoip for postfix
+    if [program] =~ /.*postfix.*/ {
+        geoip {
+            source => "postfix_client_ip"
+        }
+    }
 }