You can transform IP addresses in logs into geo locations by using the processor_geoip plug-in. The geo locations include the country, province, city, longitude, and latitude. This topic describes the parameters of the processor_geoip plug-in. This topic also provides examples to show how to configure the plug-in.

Parameters

The following table describes the parameters that you can specify in the detail parameter when you set the type parameter to processor_geoip.
Note
  • GeoIP databases are not included in the Logtail installation package. You must download and configure a GeoIP database on a local server. We recommend that you download a database that provides the city information of an IP address. For more information, see GeoLite2 Free Geolocation Data.
  • Make sure that the database format is MMDB.
Parameter Type Required Description
SourceKey String Yes The name of the source field to be converted.
DBPath String Yes The absolute path of the GeoIP database, for example, /user/data/GeoLite2-City_20180102/GeoLite2-City.mmdb.
NoKeyError Boolean No Specifies whether to report an error if a field is not matched. Default value: false. This value indicates that no error is reported if a field is not matched.
NoMatchError Boolean No Specifies whether to report an error if an IP address is invalid or is not matched in the database. Default value: false. This value indicates that no error is reported if an IP address is invalid or is not matched in the database.
KeepSource Boolean No Specifies whether to retain the source field. Default value: true. This value indicates that the source field is retained.
Language String No The language of the GeoIP database. Default value: zh-CN. Make sure that your GeoIP database can be displayed in a language that is suitable for your business.

Configuration example

The following example shows how to configure the processing method to process IP addresses in logs.
  • Raw log entry
    "source_ip" : "**. **. **. **"
  • Logtail configurations for data processing
    {
       "type": "processor_geoip",
        "detail": {
             "SourceKey": "ip",
             "NoKeyError": true,
             "NoMatchError": true,
             "KeepSource": true,
             "DBPath" : "/user/local/data/GeoLite2-City_20180102/GeoLite2-City.mmdb"
        }
    }
  • Result
    "source_ip_city_" : "**. **. **.**"
    "source_ip_province_": "Zhejiang"
    "source_ip_city_": "Hangzhou"
    "source_ip_province_code_" : "ZJ"
    "source_ip_country_code_" : "CN"
    "source_ip_longitude_" : "120.********"
    "source_ip_latitude_" : "30. ********"