Can not open GeoIP on Aggregation

[Khozzmic (Kavin)]

Hello Guys.

I enter every value which on the webpage.

Pipeline Rule:

rule "GeoIP lookup: src_ip"

when

  has_field("src_ip")

then

let geo = lookup ("geoip", to_string ($message.src_ip));

set_field ("src_ip_geo_location", geo ["coordinates"]);

set_field ("src_ip_geo_country", geo ["country"].iso_code);

set_field ("src_ip_geo_city", geo ["city"].names.en);

end

MY pipeline is:

My lookup table:

My Cache:

My Data Adapter:

and i still don t have the value here:

I don t have any idea why i don t have any action. Thanks for now.

[gsmith]

Hello @Khozzmic

I have the GeoIp working in my environment. I noticed some different configuration. Perhaps you may want to look at mine and test it out. I’m not 100% sure if it will change anything but its worth a try plus I highlight what I seen was different in red box.

My pipeline Just one rule.

My Lookup table

My Cache

Same as yours

Data Adapter is not your Data Adaptor, you put the same picture in this post twice Never the less, here is mine.

Here is the documentation for GeoIP. You seamed to miss a couple correct configuration.

Please look back over this , it may help.

How to Set Up Graylog GeoIP Configuration | Graylog