# Can not open GeoIP on Aggregation

**URL:** <https://community.graylog.org/t/can-not-open-geoip-on-aggregation/22494>\
**Category:** Graylog Central (peer support)\
**Created:** [January 27, 2022, 7:02pm UTC](https://community.graylog.org/t/can-not-open-geoip-on-aggregation/22494 "2022-01-27T19:02:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Khozzmic](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/khozzmic/32/10807_2.png) [@Khozzmic](https://community.graylog.org/u/Khozzmic)\
**Post date:** [January 27, 2022, 7:02pm UTC](https://community.graylog.org/t/can-not-open-geoip-on-aggregation/22494/1 "2022-01-27T19:02:17Z")

</div>

Hello Guys.

I enter every value which on the webpage.

# Pipeline Rule:

```auto
rule "GeoIP lookup: src_ip"

when

  has_field("src_ip")

then

let geo = lookup ("geoip", to_string ($message.src_ip));

set_field ("src_ip_geo_location", geo ["coordinates"]);

set_field ("src_ip_geo_country", geo ["country"].iso_code);

set_field ("src_ip_geo_city", geo ["city"].names.en);

end

```

# MY pipeline is:

 ![Screenshot_5](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/0/07bf7f23c26ab350254a0cc4f153529c3a6f7c23.png)

# My lookup table:

 ![Screenshot_6](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/fa656af6512d2345d2bc292a05f4867fa9ec4f82.png)

# My Cache:

 ![Screenshot_7](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/fa4f7c1cbee3667e90c3045a2d3a2446ae0f9e33.png)

# My Data Adapter:

 ![Screenshot_7](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/fa4f7c1cbee3667e90c3045a2d3a2446ae0f9e33.png)

and i still don t have the value here:

 ![Screenshot_8](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/70b6dfd6a69c1937936b0cb12c2835d21a6735da.png)

I don t have any idea why i don t have any action. Thanks for now.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [January 27, 2022, 11:46pm UTC](https://community.graylog.org/t/can-not-open-geoip-on-aggregation/22494/2 "2022-01-27T23:46:37Z")

</div>

Hello @Khozzmic

I have the GeoIp working in my environment. I noticed some different configuration. Perhaps you may want to look at mine and test it out. I’m not 100% sure if it will change anything but its worth a try plus I highlight what I seen was different in red box.

**My pipeline** Just one rule.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/77e69b2c2c385361226a08e48692be09355cf06b.png)

**My Lookup table**

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/1bac4852df6c4c75de7ebe59889999db6835e135.png)

**My Cache**

Same as yours

**Data Adapter** is not your Data Adaptor, you put the same picture in this post twice Never the less, here is mine.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/a245c802525d9a34cf7d60c355ea444c0bb5a221.png)

Here is the documentation for GeoIP. You seamed to miss a couple correct configuration.

Please look back over this , it may help.

> **[How to Set Up Graylog GeoIP Configuration | Graylog](https://www.graylog.org/post/how-to-set-up-graylog-geoip-configuration)**
>
> Having additional data on logs that contain IP addresses that gives you their Geolocation helps in your investigations and understanding of your traffic patterns. Here's a guide to set up Graylog and enrich your data with this info.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 10, 2022, 11:47pm UTC](https://community.graylog.org/t/can-not-open-geoip-on-aggregation/22494/3 "2022-02-10T23:47:21Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.