# geoip

Enrich events with geographic information using a MaxMind GeoLite2-City database at `path`.  The IP address is extracted from the event using the `ip` JS function.  Geo data is written to `target` (default: `geo`).  Events are always emitted downstream, whether enrichment succeeds or fails.

## Config

**Required:**
- `path`: Path to MaxMind GeoLite2-City `.mmdb` database file
- `ip`: JS function `(event) => string` — returns the IP address string to look up

**Optional:**
- `target`: Field name to write geo data into (default: `geo`)

## Output fields

When enrichment succeeds, the following fields are written to `event[target]`:

| Field              | Description                          |
|:-------------------|:-------------------------------------|
| `city_name`        | City name (English)                  |
| `continent_code`   | Two-letter continent code            |
| `country_iso_code` | Two-letter ISO country code          |
| `country_name`     | Country name (English)               |
| `postal_code`      | Postal/ZIP code                      |
| `location`         | `[longitude, latitude]` array        |
| `timezone`         | IANA time zone string                |

Fields are omitted if the database does not have data for that IP.

## Example

```yaml
pipeline:
  geoip:
    config:
      path: /path/to/GeoLite2-City.mmdb
      ip: "event => event.client?.ip ?? event.source?.ip ?? event.ip"
      target: geo
```