GeoIP doesn't seem to be working

Graylog Central (peer support)
1

1. Describe your incident:

I am setting up a new Graylog server. My use is case is bringing in Nginx Logs and I want to be able to use the geo-locate function on the IPs to determine where most of traffic is coming from and which are the top IPs. But I can’t seem to get the geo-locate to work. The IPs are in the field remote_addr. I have configured the locations to the maxmind databases and it finds these correctly. I seem to have seen a lot of mentioning about the Message Processor order, but can’t seem to see any solid instruction as to what is needed. Mine currently is:

  1. Message Filter Chain (active)
  2. Pipeline Processor (active)
  3. GeoIP Resolver (active)
  4. AWS Instance Name Lookup (disabled)

The content pack I am using for Nginx SysLOG is GitHub - scriptingislife/graylog-content-pack-nginx-syslog: This content pack supports the NGINX syslog feature.

2. Describe your environment:

  • OS Information: Docker

  • Package Version: 4.3.3

  • Service logs, configurations, and environment variables: Not sure how to show logs.

3. What steps have you already taken to try and solve the problem?

Researching and playing around with the message processor order.

4. How can the community help?

Need some solid advice on how to fix it.

2

I just realised that the Message Processor Order above had stopped my streams getting the messages. So I had to swap 1 and 2.

So my current order is:

  1. Pipeline Processor
  2. Message Filter Chain
  3. GeoIP Resolver

However I still don’t see any Geo info despite the logs being in the correct streams now.

3

Are you following instructions from this blog post on how to set up Graylog GeoIP Configuration This uses the pipeline to target fields that you specifically need… or are you following the documentation for scanning all messages that contain IPs and let the GEO-Location processor handle them?

4

@ adambirds : please post a screenshot of your Geolocation settings (System → Configurations. You can find the Geolocation settings under the Plugins / Geo-Location Processor section).

5

@adambirds

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.