Description of your problem
I’ve followed the following guide to setup geolocating - How to Set Up Graylog GeoIP Configuration | Graylog
I can see the new fields src_ip_city_name, src_ip_country_code, src_ip_geolocation however they are not populated. I’ve got a src_ip field setup for my log and that is populated.
I’m able to test my lookup table against an ip which comes back with all the IP coordinate details.
My message processor configuration order is:
1- Message filter chain
2- Pipline processor
3- GeoIP resolver
4- AWS instance Name lookup (disabled)
The pipeline rule is stage is -1 - its the only pipeline rule i have setup.
Any help would be appreciated.
Environmental information
Operating system information
- Ubuntu
Package versions
- Graylog 4.1
- MongoDB v4.0.26
- Elasticsearch 6.8.18
rule "GeoIP lookup: Source_IP"
when
has_field("src_ip")
then
let geo = lookup("geoip-lookup", to_string($message.src_ip));
set_field("src_ip_geo_location", geo["coordinates"]);
set_field("src_ip_geo_country", geo["country"].iso_code);
set_field("src_ip_geo_city", geo["city"].names.en);
end
For longer code or configuration bits, please enclose your snippet in a summary block like this:
Summary of your code snippet or config here
Your code goes inside the triple backticks
