Dropping tomcat/apache messages coming from same IP


I recently setup geolocation and it’s working great, however, the data that is used to create the dashboard is not exactly correct because I am grabbing the client_ip using a pipeline and then using that for my geolocation. In nature the apache/tomcat logs are logging multiple events when a user visits a webpage so what is actually one user accessing a particular webpage the dashboard is displaying like 20 or 30 logins from that IP which is incorrect because it’s just tomcat logging different resource loaded for that particular page or as the user visits different parts of the site it keeps adding to the count so my dashbard might show a count of 30 from the same IP. How do I get a more accurate resultset . Is there a way to store the IP and drop the message if that ip already exists? I am trying to figure out to just include distinct IPs

Just to add to the complexity, if your are accessing the services from work or vpn, users will have the same external client_ip because it uses the ip of the firewall interface so that makes it even more difficult.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.