# GeoIP Setup - Need help **URL:** \ **Category:** Graylog Add-ons\ **Created:** [January 23, 2024, 1:08pm UTC](https://community.graylog.org/t/geoip-setup-need-help/31302 "2024-01-23T13:08:31Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![david81](https://avatars.discourse-cdn.com/v4/letter/d/df705f/32.png) [@david81](https://community.graylog.org/u/david81)\ **Post date:** [January 23, 2024, 1:08pm UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/1 "2024-01-23T13:08:31Z")
Hi, I’m new to Graylog. I use Graylog to receive events that are written to Elasticsearch. Here I now also have entries that are visible from Sysmon on Windows devices with data\_win\_eventdata\_sourceIP and data\_win\_eventdata\_destinationIP. A stream has already been created. I also followed these instructions to activate GeoIP: [https://graylog.org/post/how-to-set-up-graylog-geoip-configuration/](https://graylog.org/post/how-to-set-up-graylog-geoip-configuration/) In the pipeline configuration I created the following rule that points to my stream ```auto rule "GeoIP lookup" when true then set_field("data_win_eventdata_sourceIp",$message.src_ip); set_field("data_win_eventdata_destinationIp",$message.dest_ip); let geo = lookup("geoip", to_string($message.src_ip)); set_field("src_ip_geo_location", geo["coordinates"]); set_field("src_ip_geo_country", geo["country"].iso_code); set_field("src_ip_geo_city", geo["city"].names.en); let geo2 = lookup("geoip", to_string($message.dest_ip)); set_field("dest_ip_geo_location", geo2["coordinates"]); set_field("dest_ip_geo_country", geo2["country"].iso_code); set_field("dest_ip_geo_city", geo2["city"].names.en); end ``` The arrangement of the message processor is as follows: - AWS Instance Name Lookup - Pipeline Processor - Stream Rule Processor - Message Filter Chain - GeoIP resolver Unfortunately, the additional fields with the geo information are not created for me. Maybe someone can help me out. Thanks David ---
**Author:** ![patrickmann](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/patrickmann/32/9091_2.png) [@patrickmann](https://community.graylog.org/u/patrickmann)\ **Post date:** [January 24, 2024, 8:54am UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/2 "2024-01-24T08:54:43Z")
Have you tried manually performing a lookup for one of the IPs on the `system/lookup tables` page? ---
**Author:** ![david81](https://avatars.discourse-cdn.com/v4/letter/d/df705f/32.png) [@david81](https://community.graylog.org/u/david81)\ **Post date:** [January 25, 2024, 12:36pm UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/3 "2024-01-25T12:36:41Z")
Manually is working ````auto { "single_value": "37.751,-97.822", "multi_value": { "continent": { "code": "NA", "geoname_id": 6255149, "names": { "de": "Nordamerika", "ru": "Северная Америка", "pt-BR": "América do Norte", "ja": "北アメリカ", "en": "North America", "fr": "Amérique du Nord", "zh-CN": "北美洲", "es": "Norteamérica" } }, "country": { "confidence": null, "geoname_id": 6252001, "is_in_european_union": false, "iso_code": "US", "names": { "de": "USA", "ru": "США", "pt-BR": "Estados Unidos", "ja": "アメリカ合衆国", "en": "United States", "fr": "États-Unis", "zh-CN": "美国", "es": "Estados Unidos" } }, "traits": { "autonomous_system_number": null, "autonomous_system_organization": null, "connection_type": null, "domain": null, "ip_address": "8.8.8.8", "is_anonymous": false, "is_anonymous_proxy": false, "is_anonymous_vpn": false, "is_hosting_provider": false, "is_legitimate_proxy": false, "is_public_proxy": false, "is_satellite_provider": false, "is_tor_exit_node": false, "isp": null, "organization": null, "user_type": null }, "city": { "confidence": null, "geoname_id": null, "names": {} }, "represented_country": { "confidence": null, "geoname_id": null, "is_in_european_union": false, "iso_code": null, "names": {}, "type": null }, "coordinates": "37.751,-97.822", "location": { "accuracy_radius": 1000, "average_income": null, "latitude": 37.751, "longitude": -97.822, "metro_code": null, "population_density": null, "time_zone": "America/Chicago" }, "postal": { "code": null, "confidence": null }, "registered_country": { "confidence": null, "geoname_id": 6252001, "is_in_european_union": false, "iso_code": "US", "names": { "de": "USA", "ru": "США", "pt-BR": "Estados Unidos", "ja": "アメリカ合衆国", "en": "United States", "fr": "États-Unis", "zh-CN": "美国", "es": "Estados Unidos" } }, "subdivisions": [] }, "string_list_value": null, "has_error": false, "ttl": 9223372036854776000 }``` ```` ---
**Author:** ![david81](https://avatars.discourse-cdn.com/v4/letter/d/df705f/32.png) [@david81](https://community.graylog.org/u/david81)\ **Post date:** [January 25, 2024, 12:49pm UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/4 "2024-01-25T12:49:57Z")
Here is my configuration ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/4/1/413da92e63a50b81f37acea30d966b4958144903.png) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/4/3/43834bd160a16dea86dcb6f53756821064931647.png) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/b/e/be4a794e36d35824fb3a60a805dadd3d8b94076b.png) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/d/6/d6ca243be6b4f6dc80a9a93f204b5c25c95b7ce1.png) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/b/3/b3e4481951405dfd6aa24dc1ed1460c20ef36b2a.png) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/d/e/de56dd53893adb9d89fceafb37ec99bd12f581b3.png) Incoming Message by Stream ```auto message <134>device_name="SFW" timestamp="2024-01-25T13:45:09+0100" device_model="XXXXXX" device_serial_id="XXXXXXXX" log_id="010101xxxxx1" log_type="Firewall" log_component="Firewall Rule" log_subtype="Allowed" log_version=1 severity="Information" fw_rule_id="x" fw_rule_name="LAN-to-WAN" fw_rule_section="Local rule" nat_rule_id="x" nat_rule_name="XXXXXX IPv4" fw_rule_type="USER" gw_id_request=x gw_name_request="XXXXX-1G" web_policy_id=xx ips_policy_id=xx app_name="DNS" app_risk=1 app_technology="Network Protocol" app_category="Infrastructure" ether_type="Unknown (0x0000)" in_interface="Port1" out_interface="Port6" src_mac="xx:xx:xx:xx:xx:xx" dst_mac="xx:xx:xx:xx:x:xx" src_ip="192.xxx.xxx.xx" src_country="R1" dst_ip="194.xx.x.xxx" dst_country="DEU" protocol="UDP" src_port=5xxx9 dst_port=xx src_trans_ip="62.xxx.xxx.xxx" src_zone_type="LAN" src_zone="LAN" dst_zone_type="WAN" dst_zone="WAN" con_event="Start" con_id="1565570657" hb_status="No Heartbeat" app_resolved_by="Signature" app_is_cloud="FALSE" qualifier="New" in_display_interface="LAN" out_display_interface="IF01-1G" log_occurrence="1" ``` ---
**Author:** ![david81](https://avatars.discourse-cdn.com/v4/letter/d/df705f/32.png) [@david81](https://community.graylog.org/u/david81)\ **Post date:** [January 25, 2024, 1:25pm UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/5 "2024-01-25T13:25:59Z")
Simulation Results ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/e/c/ec546c0a22f39a97a29e33000a56fc5231a52e52.png) ---
**Author:** ![patrickmann](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/patrickmann/32/9091_2.png) [@patrickmann](https://community.graylog.org/u/patrickmann)\ **Post date:** [January 25, 2024, 2:08pm UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/6 "2024-01-25T14:08:08Z")
Seems to me the message fields are not being parsed. Do you see a field `dst_ip` in the message table? The simulation says “not satisfied”, indicating that `has_field("dst_ip")` is false. ---
**Author:** ![david81](https://avatars.discourse-cdn.com/v4/letter/d/df705f/32.png) [@david81](https://community.graylog.org/u/david81)\ **Post date:** [January 25, 2024, 2:34pm UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/7 "2024-01-25T14:34:02Z")
I see the dst\_ip field. Is it possible that it cannot process this because the fields are separated by a space? ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/f/9/f9a876c6842ad4c2f1d90a4f6f26a3bab0d1e09b.png) ---
**Author:** ![patrickmann](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/patrickmann/32/9091_2.png) [@patrickmann](https://community.graylog.org/u/patrickmann)\ **Post date:** [January 25, 2024, 3:01pm UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/8 "2024-01-25T15:01:05Z")
The data is present in the log message. But it is apparently not being parsed out and assigned to a message field. > **[Parsing Log Files in Graylog - Overview](https://graylog.org/post/parsing-log-files-in-graylog-overview/)** > > Want to know all about parsing log files? The experts here at Graylog prepared a useful guide for you. ---
**Author:** ![david81](https://avatars.discourse-cdn.com/v4/letter/d/df705f/32.png) [@david81](https://community.graylog.org/u/david81)\ **Post date:** [January 25, 2024, 3:26pm UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/9 "2024-01-25T15:26:18Z")
I created a json extractor for the input that breaks down the entire message into individual fields. I also get the field fw\_dst\_ip. This field contains the value of the dst\_ip field of the message. But even if I use this field in my pipeline rule, I get the same reply at the simulation. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/6/d/6d358e0d6a5e01d3ca9ef2d43c501997ba5392d4.png) ---
**Author:** ![patrickmann](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/patrickmann/32/9091_2.png) [@patrickmann](https://community.graylog.org/u/patrickmann)\ **Post date:** [January 26, 2024, 8:12am UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/10 "2024-01-26T08:12:58Z")
It’s hard to remotely debug pipeline rules. Use the debug statement and/or create fields to display intermediate results in your rule to narrow down where things are not working as expected. ---
**Author:** ![david81](https://avatars.discourse-cdn.com/v4/letter/d/df705f/32.png) [@david81](https://community.graylog.org/u/david81)\ **Post date:** [January 26, 2024, 9:10am UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/11 "2024-01-26T09:10:53Z")
ERROR [PipelineRuleParser] Unable to retrieve expression for variable fw\_dst\_ip, this is a bug ---
**Author:** ![patrickmann](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/patrickmann/32/9091_2.png) [@patrickmann](https://community.graylog.org/u/patrickmann)\ **Post date:** [January 26, 2024, 9:35am UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/12 "2024-01-26T09:35:35Z")
What is the order of your message processors (system/configuration/message processors) ? ---
**Author:** ![david81](https://avatars.discourse-cdn.com/v4/letter/d/df705f/32.png) [@david81](https://community.graylog.org/u/david81)\ **Post date:** [January 26, 2024, 9:53am UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/13 "2024-01-26T09:53:26Z")
![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/4/4/44d0cb1094e77f9723651107a8b2f667a93c98ae.png) ---
**Author:** ![patrickmann](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/patrickmann/32/9091_2.png) [@patrickmann](https://community.graylog.org/u/patrickmann)\ **Post date:** [January 26, 2024, 12:05pm UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/14 "2024-01-26T12:05:14Z")
Please also post your updated pipeline rule again. Here is a pretty detailed discussion of pitfalls with geoip: > [@GEO IP Not Working](https://community.graylog.org/t/geo-ip-not-working/14846): > > Hey Everyone, I have tried millions of times to get GEO Ip working on our instance. I have installed it, reinstalled it, configured it, rebooted, re read every piece of documentation but cannot get it to show up still. ny help would be greatly appreciated! Thank you ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [February 9, 2024, 12:05pm UTC](https://community.graylog.org/t/geoip-setup-need-help/31302/15 "2024-02-09T12:05:57Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.