Graylog2 / Graylog2/graylog-plugin-integrations

GeoIP Processor Update

Open
#952 0 comments 0 reactions 1 assignee Claimed by @roberto-graylog View on GitHub
feature triaged
Dominant language
Java
Stars
17
Forks
14
PR merge metrics
No merged PRs in 30d

Description

* Run after Illuminate to ensure IP fields get
* Look for destination/host/source_ip fields
* Add tags for internal IPs (192.168 or 10.) but don't do GeoIP lookups
* Add all *_geo_* fields
* Work with Michael W on geo name logic (because sometimes geo fields like city might be missing)
* Automagically handle MaxMind or IPInfo databases
* If AS database present, add AS number and name
* Make sure in-product docs clarify what fields it looks for

The as fields are {source,host,destination}_as_organization, {}_as_number, {}_geo_coordinates, {}_geo_country, {}_geo_city, {}_geo_country_iso and the derived field {}_geo_name

Right now, {}_geo_name concatenates _geo_city and _geo_country_iso (if both exist) - "City, Country ISO"

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.