Hi,
I have a query that supplies IP address and a status code and I have created a cluster map from the results
host="*beta*" source="*access_log*" index=main |rex "(?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|rex "HTTP.\d.\d.\s+(?<status>\d+)"| iplocation src |geostats count by status
I'd like to convert this to a choropleth map but so far no luck. As this is my first time trying this I'm kinda stuck.
I think, for choropleth maps, you will need geo_* kmz files. Check your lookup definition, there should be a few. Pick the one that's appropriate for your data (countries, states etc). Then your query would look something like this (you'll have to tweak it)
host="*beta*" source="*access_log*" index=main |rex "(?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | rex "HTTP.\d.\d.\s+(?<status>\d+)" | iplocation src | lookup geo_countries latitude AS lat, longitude AS long | stats count BY featureIdField AS country | geom geo_countries featureIdField="country"
I think, for choropleth maps, you will need geo_* kmz files. Check your lookup definition, there should be a few. Pick the one that's appropriate for your data (countries, states etc). Then your query would look something like this (you'll have to tweak it)
host="*beta*" source="*access_log*" index=main |rex "(?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | rex "HTTP.\d.\d.\s+(?<status>\d+)" | iplocation src | lookup geo_countries latitude AS lat, longitude AS long | stats count BY featureIdField AS country | geom geo_countries featureIdField="country"
Hi Sundareshr,
I think with your help I got it to work. Had to make a few changes on your query. It ended up looking like this
host="*beta*" source="*access_log*" index=main |rex "(?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | rex "HTTP.\d.\d.\s+(?<status>\d+)" | iplocation src | lookup geo_countries latitude AS lat, longitude AS lon |stats count BY featureId|geom geo_countries featureId="country"