geoip

Enrich events with geographic information using a MaxMind GeoLite2-City database at path. The IP address is extracted from the event using the ip JS function. Geo data is written to target (default: geo). Events are always emitted downstream, whether enrichment succeeds or fails.

Config

Required:

path: Path to MaxMind GeoLite2-City .mmdb database file
ip: JS function (event) => string — returns the IP address string to look up

Optional:

target: Field name to write geo data into (default: geo)

Output fields

When enrichment succeeds, the following fields are written to event[target]:

Field	Description
`city_name`	City name (English)
`continent_code`	Two-letter continent code
`country_iso_code`	Two-letter ISO country code
`country_name`	Country name (English)
`postal_code`	Postal/ZIP code
`location`	`[longitude, latitude]` array
`timezone`	IANA time zone string

Fields are omitted if the database does not have data for that IP.

Example

pipeline:
  geoip:
    config:
      path: /path/to/GeoLite2-City.mmdb
      ip: "event => event.client?.ip ?? event.source?.ip ?? event.ip"
      target: geo