# Pipeline extract IPV4 address from message log

**URL:** <https://community.graylog.org/t/pipeline-extract-ipv4-address-from-message-log/20607>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, debuggingpl\
**Created:** [July 22, 2021, 4:16pm UTC](https://community.graylog.org/t/pipeline-extract-ipv4-address-from-message-log/20607 "2021-07-22T16:16:41Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![lakmal](https://avatars.discourse-cdn.com/v4/letter/l/eb8c5e/32.png) [@lakmal](https://community.graylog.org/u/lakmal)\
**Post date:** [July 22, 2021, 4:16pm UTC](https://community.graylog.org/t/pipeline-extract-ipv4-address-from-message-log/20607/1 "2021-07-22T16:16:41Z")

</div>

Dear All,  
I have configure graylog to receive my apache logs through syslog server. I’m getting all the logs now. However when i tried to show them on world map pipe line is not working.

I have added grok pattern to my messages. there after it extracts IPV4 address from the messages.  
my message is as follows.  
 ![message](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/78e3878155eae1570d8ff6087ef1546f1c01676d.png)

My pipeline rule is as follows.

rule “GeoIP lookup: ip”  
when  
has\_field(“message”)  
then  
let geo = lookup(“geoip”,to\_string($message.IP));  
set\_field(“src\_ip\_geo\_location”, geo[“coordinates”]);  
set\_field(“src\_ip\_geo\_country”, geo[“country”].iso\_code);  
set\_field(“src\_ip\_geo\_city”, geo[“city”].names.en);  
end

please let me know what could be the issue

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [July 22, 2021, 10:24pm UTC](https://community.graylog.org/t/pipeline-extract-ipv4-address-from-message-log/20607/2 "2021-07-22T22:24:12Z")

</div>

Hello && welcome

I took a quick look at your pipeline configuration and compared it to the documentation.

Your pipeline seems to be different.

> [@lakmal](#):
>
> rule “GeoIP lookup: ip”  
> when  
> has\_field(“message”)  
> then  
> let geo = lookup(“geoip”,to\_string($message.IP));  
> set\_field(“src\_ip\_geo\_location”, geo[“coordinates”]);  
> set\_field(“src\_ip\_geo\_country”, geo[“country”].iso\_code);  
> set\_field(“src\_ip\_g

And here is mine.

```auto
rule "GeoIP lookup: src_ip"
when
  has_field("src_ip")
then
let geo = lookup("geoip", to_string($message.src_ip));
set_field("src_ip_geo_location", geo["coordinates"]);
set_field("src_ip_geo_country", geo["country"].iso_code);
set_field("src_ip_geo_city", geo["city"].names.en);
end

```

Did you use these instruction for your setup?

> **[How to Set Up Graylog GeoIP Configuration](https://graylog.org/post/how-to-set-up-graylog-geoip-configuration/)**
>
> Having additional data on logs that contain IP addresses that gives you their Geolocation helps in your investigations and understanding of your traffic patterns. Here's a guide to set up Graylog and enrich your data with this info.

---

<div class="post-metadata">

**Author:** ![jrunu](https://avatars.discourse-cdn.com/v4/letter/j/aca169/32.png) [@jrunu](https://community.graylog.org/u/jrunu)\
**Post date:** [July 23, 2021, 10:49am UTC](https://community.graylog.org/t/pipeline-extract-ipv4-address-from-message-log/20607/3 "2021-07-23T10:49:49Z")

</div>

Hi,

> [@lakmal](#):
>
> let geo = lookup(“geoip”,to\_string($message.IP));

in your screenshot above that field is called IPV4 not IP. You should also check for the existence of the IPV4 field instead of the message field.

---

<div class="post-metadata">

**Author:** ![lakmal](https://avatars.discourse-cdn.com/v4/letter/l/eb8c5e/32.png) [@lakmal](https://community.graylog.org/u/lakmal)\
**Post date:** [July 25, 2021, 3:55am UTC](https://community.graylog.org/t/pipeline-extract-ipv4-address-from-message-log/20607/4 "2021-07-25T03:55:37Z")

</div>

Thanks a lot for all the replies. I had to add message filter chain to extract IPV4 address from the log message. Once I put debug line and check the log realized that pipeline rule is not getting the IPV4 address. Then I change the order in configuration page(Message processor configuration). There after Geo Location started working and now it is showing on map.

Thanks a lot for all your valuable replies.

---

<div class="post-metadata">

**Author:** ![lakmal](https://avatars.discourse-cdn.com/v4/letter/l/eb8c5e/32.png) [@lakmal](https://community.graylog.org/u/lakmal)\
**Post date:** [July 25, 2021, 3:57am UTC](https://community.graylog.org/t/pipeline-extract-ipv4-address-from-message-log/20607/5 "2021-07-25T03:57:41Z")

</div>

Good point… Changed it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 8, 2021, 3:57am UTC](https://community.graylog.org/t/pipeline-extract-ipv4-address-from-message-log/20607/6 "2021-08-08T03:57:45Z")

</div>

Closed on August 8, 2021, 3:57am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.