Geo IP
Fluentd GeoIP filter
Overview
Fluentd Filter plugin to add information about geographical location of IP addresses with Maxmind GeoIP databases. More information at https://github.com/y-ken/fluent-plugin-geoip
Configuration
GeoIP
geoip_lookup_keys (string, optional)
Specify one or more geoip lookup field which has ip address
Default: host
geoip_database (string, optional)
Specify optional geoip database (using bundled GeoLiteCity databse by default)
Default: -
geoip2_database (string, optional)
Specify optional geoip2 database (using bundled GeoLite2-City.mmdb by default)
Default: -
backend_library (string, optional)
Specify backend library (geoip2_c, geoip, geoip2_compat)
Default: -
skip_adding_null_record (*bool, optional)
To avoid get stacktrace error with [null, null]
array for elasticsearch.
Default: true
records ([]Record, optional)
Records are represented as maps: key: value
Default: -
Example GeoIP
filter configurations
apiVersion: logging.banzaicloud.io/v1beta1
kind: Flow
metadata:
name: demo-flow
spec:
filters:
- geoip:
geoip_lookup_keys: remote_addr
records:
- city: ${city.names.en["remote_addr"]}
location_array: '''[${location.longitude["remote"]},${location.latitude["remote"]}]'''
country: ${country.iso_code["remote_addr"]}
country_name: ${country.names.en["remote_addr"]}
postal_code: ${postal.code["remote_addr"]}
selectors: {}
localOutputRefs:
- demo-output
Fluentd config result:
<filter **>
@type geoip
@id test_geoip
geoip_lookup_keys remote_addr
skip_adding_null_record true
<record>
city ${city.names.en["remote_addr"]}
country ${country.iso_code["remote_addr"]}
country_name ${country.names.en["remote_addr"]}
location_array '[${location.longitude["remote"]},${location.latitude["remote"]}]'
postal_code ${postal.code["remote_addr"]}
</record>
</filter>
Last modified December 27, 2023: Version number bumps (00b4afd)