Intro

In this post I will show you how to setup GeoIP filtering with graylog.

Graylog is a great product to gather log insights. The community version is fully open source and has all features that you need to get deeper insights about your enviroment.

Configurations

Lookup Tables

First you need to configure the Lookup Table for GeoIP. Therefore we need to setup a Data Adapter.

Next, you need to configure the Caching Parameters.

The last step for the lookup table is the table itself, you need to insert the previous created Data Types.

Pipeline

To process the GeoIP you need an active pipeline, that is attached to a stream.

Therefore we need to create a Pipeline Rule.

The condition lookup name geoip-lookup in the line let geo = lookup("geoip-lookup", to_string($message.src_ip)); references to the “Lookup Table Name” created ealier.

Map Settings

To define a world map you need to perform an aggregated search.

These are my settings for GeoIP Lookup:

GeoIP Bashboard

I embedded the map into a saved search.