GeoIP still not working after installation and extractors


#1

I have added the GeoIP addon and added an extractor to separate out the IP address. However I still can’t get the GeoIP function to display the Map. Logs are stating that it is requiring latitude and longitude. Where should this be provided? Do I need to setup a GROK extractor?

I am using RHEL 6.9 and dumping everything to rsyslog

rsyslog-5.8.10.

Is this a problem with the version of rsyslog? Is there something else that I need to do?

2017-04-18T16:48:53.220Z ERROR [MapDataResource] Map data query failed: Invalid geo data term for field "Destinations":  (required: <lat>,<lng> - example: 1.23,3.11)
2017-04-18T16:51:35.335Z ERROR [MapDataResource] Map data query failed: Invalid geo data term for field "Destinations":  (required: <lat>,<lng> - example: 1.23,3.11

(Jochen) #2

You need to extract the IP address for which the geo location should be looked up into a separate field and set up the GeoIP Resolver as outlined in http://docs.graylog.org/en/2.2/pages/geolocation.html#configure-the-message-processor.