Skip to content

Pipeline: filter: geoip style update #1680

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 20, 2025
Merged

Pipeline: filter: geoip style update #1680

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dcaa056
Pipeline: filter: geoip style update
esmerel May 20, 2025
7927bb8
Apply suggestions from code review
esmerel May 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 17 additions & 18 deletions pipeline/filters/geoip2-filter.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,26 +1,28 @@
---
description: Look up Geo data from IP
description: Look up Geo data from IP.
---

# GeoIP2 Filter
# GeoIP2 filter

GeoIP2 Filter allows you to enrich the incoming data stream using location data from GeoIP2 database.
The GeoIP2 filter lets you enrich the incoming data stream with location data from the GeoIP2 database.

## Configuration Parameters <a id="config"></a>
The `GeoLite2-City.mmdb` database is available from [MaxMind's official site](https://dev.maxmind.com/geoip/geoip2/geolite2/).

## Configuration parameters

This plugin supports the following configuration parameters:

| Key | Description |
| :--- | :--- |
| database | Path to the GeoIP2 database. |
| lookup\_key | Field name to process |
| record | Defines the `KEY LOOKUP_KEY VALUE` triplet. See below for how to set up this option. |
| `database` | Path to the GeoIP2 database. |
| `lookup_key` | Field name to process. |
| `record` | Defines the `KEY LOOKUP_KEY VALUE` triplet. |

## Getting Started <a id="getting_started"></a>
## Get started

The following configuration will process incoming `remote_addr`, and append country information retrieved from GeoLite2 database.
The following configuration processes the incoming `remote_addr` and appends country information retrieved from the GeoLite2 database.

```text
```python
[INPUT]
Name dummy
Dummy {"remote_addr": "8.8.8.8"}
Expand All @@ -38,17 +40,14 @@ The following configuration will process incoming `remote_addr`, and append coun
Match *
```

Each `Record` parameter above specifies the following triplet:
Each `Record` parameter specifies the following triplet:

1. The field name to be added to records \(`country`\)
2. The lookup key to process \(`remote_addr`\)
3. The query for GeoIP2 database \(`%{country.names.en}`\)
- `country`: The field name to be added to records.
- `remote_addr`: The lookup key to process.
- `%{country.names.en}`: The GeoIP2 database query.

By running Fluent Bit with the configuration above, you will see the following output:
By running Fluent Bit with this configuration, you will see the following output:

```javascript
{"remote_addr": "8.8.8.8", "country": "United States", "isocode": "US"}
```

Note that the `GeoLite2-City.mmdb` database is available from [MaxMind's official site](https://dev.maxmind.com/geoip/geoip2/geolite2/).