# Pipeline rule - geomap for Citrix netscaler

**URL:** <https://community.graylog.org/t/pipeline-rule-geomap-for-citrix-netscaler/16229>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [July 7, 2020, 3:42am UTC](https://community.graylog.org/t/pipeline-rule-geomap-for-citrix-netscaler/16229 "2020-07-07T03:42:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![hgmutir](https://avatars.discourse-cdn.com/v4/letter/h/85f322/32.png) [@hgmutir](https://community.graylog.org/u/hgmutir)\
**Post date:** [July 7, 2020, 3:42am UTC](https://community.graylog.org/t/pipeline-rule-geomap-for-citrix-netscaler/16229/1 "2020-07-07T03:42:04Z")

</div>

Hello.

im trying to extract the the source ip from message filed and add it to new filed to add it in the dashboard map

 ![graylog](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/0/0fc211da770b646f1368a607156510e7830d181d.png)

my problem there is a filed with name source  
how to write the correct code to add message filed and chose the source part

> ```
> rule "src_ip"
> when
> has_field("source")
> then
> let geo = lookup("src_ip", to_string($message.source));
> set_field("src_ip_geo_location", geo["coordinates"]);
> set_field("src_ip_geo_country", geo["country"].iso_code);
> set_field("src_ip_geo_city", geo["city"].names.en);
> end
> 
> ```

also the “src\_ip\_geo\*” new filed never appear in the map

Thanks

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [July 7, 2020, 12:54pm UTC](https://community.graylog.org/t/pipeline-rule-geomap-for-citrix-netscaler/16229/2 "2020-07-07T12:54:07Z")

</div>

1. First based on your screenshot, you try to GeoIP for LAN subnet addresses (10.X.X.X) which of course can’t contain GeoIP information, because it’s not Internet IP
2. Second you need to extract IP from message, do you have it? You you field source in your pipeline rule, but I don’t know if it contains correct ip.
3. Widget map uses GeoIP coordinates to display point in map, so you need to use field: `src_ip_geo_location` in your case

---

<div class="post-metadata">

**Author:** ![hgmutir](https://avatars.discourse-cdn.com/v4/letter/h/85f322/32.png) [@hgmutir](https://community.graylog.org/u/hgmutir)\
**Post date:** [July 7, 2020, 2:01pm UTC](https://community.graylog.org/t/pipeline-rule-geomap-for-citrix-netscaler/16229/3 "2020-07-07T14:01:56Z")

</div>

@shoothub  
Thanks alot for your replay

for the first point the same load balancer VIP accessible from internet using nat ip so internet users public ip will appear if the url requested from internet .

for the second point their is source filed but its for the load balancer ip, the clint ip appear in the message filed as a part from the message filed text so i need to extract it from the message filed data.

for the third point src\_ip\_geo\_location is not appear in the row filed in map dashboard.

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [July 8, 2020, 7:44am UTC](https://community.graylog.org/t/pipeline-rule-geomap-for-citrix-netscaler/16229/4 "2020-07-08T07:44:24Z")

</div>

Try tu use this GROK in grok extractor (with `Named captures only`):

```auto
%{DATE_US}:%{TIME}%{SPACE}%{SYSLOGHOST:syslog_hostname} %{GREEDYDATA:netscaler_message} : %{DATA} %{IP:source_ip}:%{POSINT:source_port} - %{DATA} %{IP:vserver_ip}:%{POSINT:vserver_port} - %{DATA} %{IP:nat_ip}:%{POSINT:nat_port} - %{DATA} %{IP:destination_ip}:%{POSINT:destination_port} - %{DATA} %{DATE_US:delink_date}:%{TIME:delink_time} - %{DATA} %{POSINT:total_bytes_sent} - %{DATA} %{POSINT:total_bytes_recv}

```

If you want to extract only source\_ip field, remove `:field_name` from grok pattern:  
[https://docs.graylog.org/en/3.3/pages/extractors.html#using-grok-patterns-to-extract-data](https://docs.graylog.org/en/3.3/pages/extractors.html#using-grok-patterns-to-extract-data)

---

<div class="post-metadata">

**Author:** ![hgmutir](https://avatars.discourse-cdn.com/v4/letter/h/85f322/32.png) [@hgmutir](https://community.graylog.org/u/hgmutir)\
**Post date:** [July 10, 2020, 12:29pm UTC](https://community.graylog.org/t/pipeline-rule-geomap-for-citrix-netscaler/16229/5 "2020-07-10T12:29:09Z")

</div>

Thanks a lot for your great help

 ![Untitled](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/d8a4ac3aa6bcc29e2868afa23c84a9c4a837fd2d.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 24, 2020, 12:29pm UTC](https://community.graylog.org/t/pipeline-rule-geomap-for-citrix-netscaler/16229/6 "2020-07-24T12:29:10Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.