Geo_ip_lookup unable to parse ip address

Graylog Central (peer support)
,
1

I am getting a strange error when using geoip. [MaxmindDataAdapter] Unable to parse IP address, returning empty result.
rule “rule geoip lookup”
when
has_field(“o365_client_ip”)
then
let ip = $message.o365_client_ip;
let geo = lookup(“geo_lookup”, to_string(ip));
let debug_message = concat(
first: "geo_location: ",
second: to_string(ip));
debug(debug_message);

set_field(“o365_client_ip_country_code”, geo[“country”].iso_code);

end

But if I manually put an ip in inverted double commas it get the result. any idea what I am doing wrong here.

Using latest 3.3.5 version.

Thanks in advance.

2

try to replace line let ip = with:
let ip = to_string($message.o365_client_ip);

3

I have tried this but still the same issue: [MaxmindDataAdapter] Unable to parse IP address, returning empty result.
2020-09-26T21:22:16.121+05:00 INFO [Function] PIPELINE DEBUG: geo_location: “101.xx.xx.xxx”

rule “rule geoip lookup”
when
has_field(“o365_client_ip”)
then
let ip = to_string($message.o365_client_ip);
let geo = lookup(“geo_lookup”, ip);
let debug_message = concat(
first: "geo_location: ",
second: to_string(ip));
debug(debug_message);

set_field(“o365_client_ip_country_code”, geo[“country”].iso_code);

end

any help! Thanks in advance.

4

is it? ip =“IP” from to_string($message.o365_client_ip); , and it is looking for ip=IP without quotes? to_ip changes to 0.0.0.0 but not giving parse error? any ideas

5

finally solved: double quotes were the problem, had to parse ip first without quotes and then used for geoip, in stages. Thanks

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.