Pipeline rule - geomap for Citrix netscaler

[hgmutir (hossam)]

Hello.

im trying to extract the the source ip from message filed and add it to new filed to add it in the dashboard map

my problem there is a filed with name source
how to write the correct code to add message filed and chose the source part

rule "src_ip"
when
  has_field("source")
then
let geo = lookup("src_ip", to_string($message.source));
set_field("src_ip_geo_location", geo["coordinates"]);
set_field("src_ip_geo_country", geo["country"].iso_code);
set_field("src_ip_geo_city", geo["city"].names.en);
end

also the “src_ip_geo*” new filed never appear in the map

Thanks

[shoothub]

1. First based on your screenshot, you try to GeoIP for LAN subnet addresses (10.X.X.X) which of course can’t contain GeoIP information, because it’s not Internet IP
2. Second you need to extract IP from message, do you have it? You you field source in your pipeline rule, but I don’t know if it contains correct ip.
3. Widget map uses GeoIP coordinates to display point in map, so you need to use field: src_ip_geo_location in your case

[hgmutir (hossam)]

@shoothub
Thanks alot for your replay

for the first point the same load balancer VIP accessible from internet using nat ip so internet users public ip will appear if the url requested from internet .

for the second point their is source filed but its for the load balancer ip, the clint ip appear in the message filed as a part from the message filed text so i need to extract it from the message filed data.

for the third point src_ip_geo_location is not appear in the row filed in map dashboard.

[shoothub]

Try tu use this GROK in grok extractor (with Named captures only):

%{DATE_US}:%{TIME}%{SPACE}%{SYSLOGHOST:syslog_hostname} %{GREEDYDATA:netscaler_message} : %{DATA} %{IP:source_ip}:%{POSINT:source_port} - %{DATA} %{IP:vserver_ip}:%{POSINT:vserver_port} - %{DATA} %{IP:nat_ip}:%{POSINT:nat_port} - %{DATA} %{IP:destination_ip}:%{POSINT:destination_port} - %{DATA} %{DATE_US:delink_date}:%{TIME:delink_time} - %{DATA} %{POSINT:total_bytes_sent} - %{DATA} %{POSINT:total_bytes_recv}

If you want to extract only source_ip field, remove :field_name from grok pattern:
https://docs.graylog.org/en/3.3/pages/extractors.html#using-grok-patterns-to-extract-data

[hgmutir (hossam)]

Thanks a lot for your great help