No <custom_field>_geolocation field(s) gets generated by the GeoIP Resolver? (Solved)

Graylog Add-ons
1

Hi,

I’ve activated Geolocation according to the documentation http://docs.graylog.org/en/2.2/pages/geolocation.html and it automatically started to work for the generic “source” field (I did get a source_geolocation etc. which I can make a map widget of etc.)

But the “source” field is uninteresting, so I’ve created extractor that extracts IP-addresses from various logs, for example the ssh log. (done via a regexp extractor)

However, although the new field “ssh_remote_ip” now exists (with valid IP addresses), the GeoIP resolver doesn’t pickup those, as no “ssh_remote_ip_geolocation” etc. field(s) are being generated.
The isn’t anything about GeoIP in /var/log/graylog-server/server.log either
What could be going wrong?

I should probably have mentioned that this is Graylog version 2.2.3

Graylog-GeoIP
Graylog-GeoIP.png1089×777 160 KB

2

Ok, it was the GeoIP Resolver that had gone before the Message Filter Chain, so it was working as intended…

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.