GeoIP Transform

The Vector geoip transform enriches logs from MaxMind GeoIP2 and GeoLite2 city databases.

Requirements

Configuration

[transforms.my_transform_id]
type = "geoip" # required
inputs = ["my-source-or-transform-id"] # required
database = "/path/to/GeoLite2-City.mmdb" # required
source = "ip_address" # required
target = "geoip" # optional, default
  • commonrequiredstring

    database

    Path to the MaxMind GeoIP2 or GeoLite2 binary city database file (GeoLite2-City.mmdb). Other databases, such as the the country database are not supported.

    • View examples
  • commonrequiredstring

    source

    The field name that contains the IP address. This field should contain a valid IPv4 or IPv6 address.

    • View examples
  • commonoptionalstring

    target

    The default field to insert the resulting GeoIP data into. See output for more info.

    • Default: "geoip"
    • View examples

Output

This component outputs log events with the following fields:

{
"geoip" : {
"city_name" : "New York",
"continent_code" : "AF",
"country_code" : "US",
"latitude" : "51.75",
"longitude" : "-1.25",
"postal_code" : "07094",
"timezone" : "America/New_York"
}
}
  • commonrequiredtable

    geoip

    The root field containing all geolocation data as sub-fields.

    • commonrequiredstring

      city_name

      The city name associated with the IP address.

      • View examples
    • enumcommonrequiredstring

      continent_code

      The continent code associated with the IP address.

      • Enum, must be one of: "AF" "AN" "AS" "EU" "NA" "OC" "SA"
      • View examples
    • commonrequiredstring

      country_code

      The ISO 3166-2 country codes associated with the IP address.

      • View examples
    • commonrequiredstring

      latitude

      The latitude associated with the IP address.

      • View examples
    • commonrequiredstring

      longitude

      The longitude associated with the IP address.

      • View examples
    • commonrequiredstring

      postal_code

      The postal code associated with the IP address.

      • View examples
    • commonrequiredstring

      timezone

      The timezone associated with the IP address in IANA time zone format. A full list of time zones can be found here.

      • View examples

Telemetry

This component provides the following metrics that can be retrieved through the internal_metrics source. See the metrics section in the monitoring page for more info.

  • counter

    processed_events_total

    The total number of events processed by this component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • file - The file that produced the error

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • counter

    processed_bytes_total

    The total number of bytes processed by the component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

How It Works