# Graylog 4.0.5 - GeoIP does not work **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** pipeline-rules\ **Created:** [May 20, 2021, 2:10pm UTC](https://community.graylog.org/t/graylog-4-0-5-geoip-does-not-work/19916 "2021-05-20T14:10:28Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [May 20, 2021, 2:10pm UTC](https://community.graylog.org/t/graylog-4-0-5-geoip-does-not-work/19916/1 "2021-05-20T14:10:29Z")
Hello. I am trying to set up GeoIP, but am a little confused about Pipelines. I have a firewall and collect logs using Graylog. The logs are very different. I wanted to display on the world map the blocked IP addresses (users, remote users) that were blocked when trying to get illegal access to the firewall. Steps taken: 1. Downloaded the GeoLite2-City.mmdb database; 2. Copied to the /etc/graylog/server/; 3. Configured Data Adapters System → Lookup Tables → Data Adapters button → Create data adapter: Data adapter type → Geo IP - MaxMindTM Databases Title: GeoIP Description: GeoIP Lookup Table Name: geoip File Path: /etc/graylog/server/GeoLite2-City.mmdb Database type: City database 1. Configured Caches System → Lookup Tables → Caches button → Create cache button Cache Type: Node-local, in-memory cache Title: GeoIP Description: GeoIP Cache Name: geoip 1. Configured Lookup Tables System → Lookup Tables → Lookup Tables (active by default) → Create Lookup Table Title: GeoIP Description: GeoIP Lookup Name: geoip Data Adapter: GeoIP (geoip) Cache: GeoIP (geoip) 1. Setting up the Pipeline System → Pipelines → Manage rules button → Create Rule button Description: Incoming connections Rule source: rule “GeoIP lookup: remote\_addr” when has\_field (“remote\_addr”) then let geo = lookup (“geoip”, to\_string ($ message.remote\_addr)); set\_field (“remote\_addr\_geo\_location”, geo [“coordinates”]); set\_field (“remote\_addr\_geo\_country”, geo [“country”]. iso\_code); set\_field (“remote\_addr\_geo\_city”, geo [“city”]. names.en); end Now the pipeline: System → Pipelines → button Manage pipelines → button Add new pipeline Title: GeoIP Description: Incoming connections Click the Edit connections button, connect: All messages And also in Stage 0, click Edit and add a rule to it: GeoIP lookup: remote\_addr I cannot find further in the field: ip, geo\_ip. The Message Processors Configuration settings were corrected: 1 AWS Instance Name Lookup 2 GeoIP Resolver 3 Message Filter Chain 4 Pipeline Processor It seems to me that something needs to be added to the stream. Stuck on the sixth point and in the stream settings. Thank You for attention. Regards, Tomcat7. ---
**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\ **Post date:** [May 20, 2021, 5:44pm UTC](https://community.graylog.org/t/graylog-4-0-5-geoip-does-not-work/19916/2 "2021-05-20T17:44:38Z")
1. First check if lookup table works by enter internet ip address 2. Check if your field `remote_ip` contains correct internet ip address 3. Try to use pipeline function `debug()` and check graylog logs file `concat("remote ip: ", to_string($message.remote_addr));` and then `sudo tail -f /var/log/graylog-server/server.log` ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 20, 2021, 11:54pm UTC](https://community.graylog.org/t/graylog-4-0-5-geoip-does-not-work/19916/3 "2021-05-20T23:54:17Z")
@Tomcat7 Hello, Just chiming in, I have successfully start and configured GeoIP from this documention below. > **[How to Set Up Graylog GeoIP Configuration | Graylog](https://www.graylog.org/post/how-to-set-up-graylog-geoip-configuration)** I’m not sure if you followed those instruction but I noticed you had some different configurations. Your pipeline ``` rule “GeoIP lookup: remote_addr” when has_field (“remote_addr”) then let geo = lookup (“geoip”, to_string ($ message.remote_addr)); set_field (“remote_addr_geo_location”, geo [“coordinates”]); set_field (“remote_addr_geo_country”, geo [“country”]. iso_code); set_field (“remote_addr_geo_city”, geo [“city”]. names.en); ``` end Here is a visual on my configuration. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/e/e8fbbc225499b701b98928ad044cd2a9738ec53b.png) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4e6a87737f4205c865dfae3f69d19e4b72b5e5a2.png) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/a349604abf0050e8c41cc8a9b1e8e2834a82ad7f.png) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/93180295bd228585d629fe3e1df0e5adbf6b677c.png) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/c76c3a4d0ad25124f2187aebcf0ccfce7286510c.png) Hope that helps. ---
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [May 22, 2021, 8:53pm UTC](https://community.graylog.org/t/graylog-4-0-5-geoip-does-not-work/19916/4 "2021-05-22T20:53:55Z")
Hello Shoothub. 1. I tried to check lookup table, i can’t find. I read documentation, but I don’t understand nothing. 2. I read documentation, but I don’t understand nothing. 3. In the logs, messages only about the absence of a license for the database. I will re-read the documentation, I seem to have done it according to the instructions. ---
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [May 22, 2021, 9:14pm UTC](https://community.graylog.org/t/graylog-4-0-5-geoip-does-not-work/19916/5 "2021-05-22T21:14:05Z")
Hello Gsmith Corrected Pipeline rule and Message Processors Configuration, but the field with the name srcip\_geolocation does not appear and cities do not appear on the map. The firewall blocks users and adds the prefix “Blacklisted” to the log, and then everything is sent to the Graylog. It seems to me that we need to create a stream and a rule for it. So that he extracts the public IP address from the message and then searches the database and displays it on the map. While reading the documentation and looking at examples of creating rules for a stream. ![2021-05-23_2-03-00](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/8dd34ae2f764ed0eef8f2040f6c4e09b02073cc8.jpeg) ---
**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\ **Post date:** [May 24, 2021, 8:04am UTC](https://community.graylog.org/t/graylog-4-0-5-geoip-does-not-work/19916/6 "2021-05-24T08:04:05Z")
You probably don’t undestand how geoip with pipeline rule works. You need to extract IP address in separate field before using pipeline rule and GeoIP. So first check how to extract this IP using either extractor (GROK, regex) or pipeline rule to separate field. Then use this field as input in pipeline rule. [https://docs.graylog.org/en/4.0/pages/extractors.html](https://docs.graylog.org/en/4.0/pages/extractors.html) ---
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [May 24, 2021, 8:32am UTC](https://community.graylog.org/t/graylog-4-0-5-geoip-does-not-work/19916/7 "2021-05-24T08:32:19Z")
> [@shoothub](#): > > You probably don’t undestand how geoip with pipeline rule works. You need to extract IP address in separate field before using pipeline rule and GeoIP. So first check how to extract this IP using either extractor (GROK, regex) or pipeline rule to separate field. Then use this field as input in pipeline rule. Hello Ok, I will try to do that. As soon as it turns out, I will definitely write how it turned out to be done. I think it will help other people. ---
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [May 31, 2021, 6:20am UTC](https://community.graylog.org/t/graylog-4-0-5-geoip-does-not-work/19916/8 "2021-05-31T06:20:10Z")
Hello It turned out to be done. 1. Created Index (Indices) for firewall; 2. Created Stream for firewall; 3. Created Grok Pattern for input firewall; %{IPV4: src\_ip} 4. Created Pipeline and rules; rule “GeoIP lookup: src\_ip” when has\_field(“src\_ip”) then let geo = lookup(“geoip”, to\_string($message.src\_ip)); set\_field(“src\_ip\_geo\_location”, geo[“coordinates”]); set\_field(“src\_ip\_geo\_country”, geo[“country”].iso\_code); set\_field(“src\_ip\_geo\_city”, geo[“city”].names.en); end 5. Message Processors Configuration |1| Message Filter Chain |2| Pipeline Processor |3| GeoIP Resolver |4| AWS Instance Name Lookup ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [June 14, 2021, 6:20am UTC](https://community.graylog.org/t/graylog-4-0-5-geoip-does-not-work/19916/9 "2021-06-14T06:20:17Z")
Closed on June 14, 2021, 6:20am UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.