GeoIP i don't see this red sign either

Hi !
referance doc [How to Set Up Graylog GeoIP Configuration - Graylog]

my rule :
rule “GeoIP lookup: src_ip”
when
has_field (“src_ip”)
then
let geo = lookup (“geoip”, to_string ($message.src_ip));
set_field (“src_ip_geo_location”, geo [“coordinates”]);
set_field (“src_ip_geo_country”, geo [“country”]. iso_code);
set_field (“src_ip_geo_city”, geo [“city”]. names.en);
end

and my logs

but why dont show new fields (in rule : src_ip_geo_country, src_ip_geo_city ,src_ip_geo_location) on my log ???

i don’t see this red sign either on my widget why???
my widget :slight_smile:

I would be glad if you help

Is the src_ip_geo_location field cretaed in new logs ?
If yes, then you need to use that in the widget configuration (rather than src_ip).

but it doesn’t appear in the fields, so I can’t use it @H2Cyber

Do you use the Message Filter Chain (=Rules in the Stream overview) to filter your message into streams? And are your logs on another stream than all messages? I would guess that your pipline is run first, but the messages are not in the according streams at that moment.

I’m not quite sure what you mean, but did you mention this place? @ihe

This one I mean:
grafik
https://myserver.graylog/streams

its here @ihe

yes, this “Manage Rules” I was thinking of.
If you filter your message here from all messages to ufw stream you will not be able to run pipelines on the stream. First your Pipelines run, and then you push your messages into the right stream. See the order for this in your first post. The pipeline will simply not have any messages for processing.

ı dont understand sorry . why dont show new field on my new log ?? @ihe

you posted your Rule

I assume this rule to be attached to a Pipeline in a stage. And I assume this Pipeline to be attached to the stream “ufw stream”, correct?
If this is the case this happens:

  1. the pipelines run, with the messages in theirs streams. Your pipeline is attached to the stream ufw stream.
  2. the Message Filter Chain will run and put the messages out of “all messges” into ufw stream
  3. there is no more processing with pipelines, as is already happend.

I think you will need to switch the order of Pipeline Processor and Message Filter Chain in your processing.

thank you for your explanation. I changed the order, but he didn’t show up again. @ihe

  1. is my assumtion about your rule correct?
  2. The Message Filter Chain needs to be before the Pipeline Processor.

this is my stream rule .

pipeline conf.

and pipeline rule

where is my wrong ? ı dont understand @ihe

Your Pipeline is attached to All Messages, in this case it is correct to have the filter-chain after the Pipelines.

Try this Rule

rule "geolocation coords lookup"
when
  has_field("src_ip") 
then
  let result = lookup_value("geoip", $message.src_ip);
  set_field(field:"src_ip_geo_location", value:result);
end

How did you configure your Lookup-Table for “geoip”?

i added the rule you said and my lookup conf : @ihe

this cache:

this adapter :

Did you try to put in a test-value into the Test-Lookup?

yes am tested i write my ip adreess but return null why @ihe

192.168.0.0/16 is RFC space and not routed in the internet. Every local lan could use it - geo-ip makes no sense in this case. Try a public IP instead:

1 Like

yes worked. but why dont show on widget ? @ihe

Hello @er213

Just chiming in,

From what I seen so far is…
192.168.x.x. is a private address so you will not see the “Red” dot on the widget , it works on the Public IP Addresses. that why 8.8.8.8 works. It a DNS public server and your address 192.168.xxx.xxx which is private.

This was explained in @ihe statement above.

Check list

Message Processors Configuration is in the correct order
Pipeline is attached to the correct stream.