Documentation refers to "Illuminate Processor" but nothing like that exits on my system

Graylog Central (peer support)
1

My setup isn’t anything special and the install of 6.1 from repo’s went great. But all the documentation, like this one that I am trying to setup:

Refers to “Illuminate Processor”. But nothing like that exists in my setup:

graylog_processor
graylog_processor840×411 34.7 KB

Am I missing something?

2

Illuminate is an enterprise feature, if you have the enterprise version installed (but not licensed) it will show in the lost, but do nothing, and im pretty sure if you installed the open version it will not be in the list.

3

It would be nice if that were more clear in the documentation so I didn’t waste my time trying to figure out what is wrong with my install.

Is there a version of documentation that explains how to do geo tagging for the open version? Because even though the Geo stuff is installed, there is no lookup map for it like the documentation describes.

4

the open version will be able to work with geoDBs as well:

  1. get a mmdb-file from the vendor of your choice
  2. put it on your graylog system, memorize the path
  3. go on “System” / “Lookup Tables”
  4. create a new data adapter of the type Geo IP
  5. create a new Cache to make sure your disk is not hammered with requests
  6. create a lookup table using the data adapter and the cace
  7. use them in a pipe line rule like this:
rule "enrichment - geo ip on source_ip"
when
  has_field("source_ip") 
then
  let coords = lookup_value("geolite-country-lookup", $message.source_ip);
  set_field("source_ip_geo_location", coords);
end

This will take the source_ip, do a lookup of that value in the lookup table “geolite-country-lookup” and save the result in the field source_ip_geo_location.

5

There’s no difference in setting up the Geolocation Processor on Graylog Open and Graylog Enterprise. You can follow the instructions on the page you originally linked and just ignore all the talk about Illuminate.

You just download a geo-ip database file from either MaxMind or IPInfo, put it on your Graylog server, tell the Geolocation processor where to find it, and make sure the Geolocation processor is enabled.

But you should read the part of the docs page about setting the schema enforcement flag on or off for the Geolocation Processor.