Pipeline rule - geomap for Citrix netscaler


im trying to extract the the source ip from message filed and add it to new filed to add it in the dashboard map

my problem there is a filed with name source
how to write the correct code to add message filed and chose the source part

rule "src_ip"
let geo = lookup("src_ip", to_string($message.source));
set_field("src_ip_geo_location", geo["coordinates"]);
set_field("src_ip_geo_country", geo["country"].iso_code);
set_field("src_ip_geo_city", geo["city"].names.en);

also the “src_ip_geo*” new filed never appear in the map


  1. First based on your screenshot, you try to GeoIP for LAN subnet addresses (10.X.X.X) which of course can’t contain GeoIP information, because it’s not Internet IP
  2. Second you need to extract IP from message, do you have it? You you field source in your pipeline rule, but I don’t know if it contains correct ip.
  3. Widget map uses GeoIP coordinates to display point in map, so you need to use field: src_ip_geo_location in your case

Thanks alot for your replay

for the first point the same load balancer VIP accessible from internet using nat ip so internet users public ip will appear if the url requested from internet .

for the second point their is source filed but its for the load balancer ip, the clint ip appear in the message filed as a part from the message filed text so i need to extract it from the message filed data.

for the third point src_ip_geo_location is not appear in the row filed in map dashboard.

Try tu use this GROK in grok extractor (with Named captures only):

%{DATE_US}:%{TIME}%{SPACE}%{SYSLOGHOST:syslog_hostname} %{GREEDYDATA:netscaler_message} : %{DATA} %{IP:source_ip}:%{POSINT:source_port} - %{DATA} %{IP:vserver_ip}:%{POSINT:vserver_port} - %{DATA} %{IP:nat_ip}:%{POSINT:nat_port} - %{DATA} %{IP:destination_ip}:%{POSINT:destination_port} - %{DATA} %{DATE_US:delink_date}:%{TIME:delink_time} - %{DATA} %{POSINT:total_bytes_sent} - %{DATA} %{POSINT:total_bytes_recv}

If you want to extract only source_ip field, remove :field_name from grok pattern:

Thanks a lot for your great help

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.