Graylog2 / Graylog2/graylog-plugin-integrations
GeoIP Processor Update
- Dominant language
- Java
- Stars
- 17
- Forks
- 14
- PR merge metrics
- No merged PRs in 30d
Description
* Run after Illuminate to ensure IP fields get
* Look for destination/host/source_ip fields
* Add tags for internal IPs (192.168 or 10.) but don't do GeoIP lookups
* Add all *_geo_* fields
* Work with Michael W on geo name logic (because sometimes geo fields like city might be missing)
* Automagically handle MaxMind or IPInfo databases
* If AS database present, add AS number and name
* Make sure in-product docs clarify what fields it looks for
The as fields are {source,host,destination}_as_organization, {}_as_number, {}_geo_coordinates, {}_geo_country, {}_geo_city, {}_geo_country_iso and the derived field {}_geo_name
Right now, {}_geo_name concatenates _geo_city and _geo_country_iso (if both exist) - "City, Country ISO"
Contributor guide
Assessment
This issue has not been assessed yet.