GeoIP Transform

The Vector geoip transform accepts log events and allows you to enrich events with geolocation data from the MaxMind GeoIP2 and GeoLite2 city databases.

Configuration

vector.toml

[transforms.my_transform_id]
  # REQUIRED
  type = "geoip" # must be: "geoip"
  inputs = ["my-source-id"] # example
  database = "/path/to/GeoLite2-City.mmdb" # example
  source = "ip_address" # example
  # OPTIONAL
  target = "geoip" # default

Options

3 items

common onlyrequired only

commonstringrequired

database

Path to the MaxMind GeoIP2 or GeoLite2 binary city database file (GeoLite2-City.mmdb). Other databases, such as the the country database are not supported.

No default

View examples

commonstringrequired

source

The field name that contains the IP address. This field should contain a valid IPv4 or IPv6 address.

No default

View examples

commonstringrequired

target

The default field to insert the resulting GeoIP data into. See output for more info.

Default: "geoip"

View examples

Output

The geoip transform accepts log events and allows you to enrich events with geolocation data from the MaxMind GeoIP2 and GeoLite2 city databases. For example:

{
  "geoip": {
    "city_name": "New York",
    "continent_code": [
      "AF",
      "Africa"
    ],
    "country_code": "US",
    "latitude": "51.75",
    "longitude": "-1.25",
    "postal_code": "07094",
    "timezone": "America/New_York"
  }
}

More detail on the output schema is below.

structoptional

geoip

The root field containing all geolocation data as sub-fields.

stringrequired

city_name

The city name associated with the IP address.

No default

View examples

stringenumrequired

continent_code

The continent code associated with the IP address.

No default

Enum, must be one of: "AF" "AN" "AS" "EU" "NA" "OC" "SA"

View examples

stringrequired

country_code

The ISO 3166-2 country codes associated with the IP address.

No default

View examples

stringrequired

latitude

The latitude associated with the IP address.

No default

View examples

stringrequired

longitude

The longitude associated with the IP address.

No default

View examples

stringrequired

postal_code

The postal code associated with the IP address.

No default

View examples

stringrequired

timezone

The timezone associated with the IP address in IANA time zone format. A full list of time zones can be found here.

No default

View examples

How It Works

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.