Geo-Location Processor and multiple IPs inf field

[gsmith]

@darrinh

I can’t change the order of the processors because there is a pipeline that an extractor relies on.

The that might be your problem, also

@darrinh

I have created an extractor that grabs the ip of interest and puts in its own field.

If you did this then the GeoIP pipeline might be not able to get the field below.

when

  has_field("src_ip")

then

This post might be able to help.

Graylog 4.0.5 - GeoIP does not work

@Tomcat7 Hello, Just chiming in, I have successfully start and configured GeoIP from this documention below. I’m not sure if you followed those instruction but I noticed you had some different configurations. Your pipeline rule “GeoIP lookup: remote_addr” when has_field (“remote_addr”) then let geo = lookup (“geoip”, to_string ($ message.remote_addr)); set_field (“remote_addr_geo_location”, geo [“coordinates”]); set_field (“remote_addr_geo_country”, geo [“country”…