@shoothub
For example can I use thish code:
rule “GeoIP lookup: src_ip”
when
has_field(“gl2_remote_ip”)
then
let geo = lookup(“geoip”, to_string($message.gl2_remote_ip));
set_field(“gl2_remote_ip_geo_location”, geo[“coordinates”]);
set_field(“gl2_remote_ip_geo_country”, geo[“country”].iso_code);
set_field(“gl2_remote_ip_geo_city”, geo[“city”].names.en);
end