You can transform IP addresses in logs into geo locations by using the processor_geoip plug-in. The geo locations include the country, province, city, longitude, and latitude. This topic describes the parameters of the processor_geoip plug-in. This topic also provides examples to show how to configure the plug-in.
Parameters
The following table describes the parameters that you can specify in the detail parameter when you set the type parameter to processor_geoip.
Note
- GeoIP databases are not included in the Logtail installation package. You must download and configure a GeoIP database on a local server. We recommend that you download a database that provides the city information of an IP address. For more information, see GeoLite2 Free Geolocation Data.
- Make sure that the database format is MMDB.
Parameter | Type | Required | Description |
---|---|---|---|
SourceKey | String | Yes | The name of the source field to be converted. |
DBPath | String | Yes | The absolute path of the GeoIP database, for example, /user/data/GeoLite2-City_20180102/GeoLite2-City.mmdb. |
NoKeyError | Boolean | No | Specifies whether to report an error if a field is not matched. Default value: false. This value indicates that no error is reported if a field is not matched. |
NoMatchError | Boolean | No | Specifies whether to report an error if an IP address is invalid or is not matched in the database. Default value: false. This value indicates that no error is reported if an IP address is invalid or is not matched in the database. |
KeepSource | Boolean | No | Specifies whether to retain the source field. Default value: true. This value indicates that the source field is retained. |
Language | String | No | The language of the GeoIP database. Default value: zh-CN. Make sure that your GeoIP database can be displayed in a language that is suitable for your business. |
Configuration example
The following example shows how to configure the processing method to process IP addresses
in logs.
- Raw log entry
"source_ip" : "**. **. **. **"
- Logtail configurations for data processing
{ "type": "processor_geoip", "detail": { "SourceKey": "ip", "NoKeyError": true, "NoMatchError": true, "KeepSource": true, "DBPath" : "/user/local/data/GeoLite2-City_20180102/GeoLite2-City.mmdb" } }
- Result
"source_ip_city_" : "**. **. **.**" "source_ip_province_": "Zhejiang" "source_ip_city_": "Hangzhou" "source_ip_province_code_" : "ZJ" "source_ip_country_code_" : "CN" "source_ip_longitude_" : "120.********" "source_ip_latitude_" : "30. ********"