Geolocation
  • 25 Jul 2022
  • 2 Minutes to read
  • Dark
    Light

Geolocation

  • Dark
    Light

Graylog lets you extract and visualize geolocation information from IP addresses in your logs. In this section, you'll learn how to configure the geolocation processor, which has been updated in the Graylog 4.3 release. Additionally, you'll learn how to create a map with the extracted geo-information.

Setup the Processor

Graylog ships with geolocation capabilities by default but additional configuration is still required. This section explains how to configure the functionality in detail.

Download the Database

To start, download a geolocation database. As of version 4.3, both MaxMind and IPInfo databases are supported by Graylog.

Note

As of December 30, 2019, you will need to create an account to obtain a license key to download the MaxMind database(s). More information is available on MaxMind’s blog post.

The next step is to store the geolocation database on all servers running Graylog. Make sure you grant the right permissions to the file so the user running Graylog can read the database.

Configure the Processor

You will need to configure Graylog to start using the geolocation database to resolve IPs in your logs. To ensure the correct order of operations occurs, verify that the configuration of the Illuminate Processor is executed before the GeoIP Resolver. Navigate to System > Configurations and locate the "Message Processors Configuration" setting at the top right.

Geolocation_4.3_0

Ensure that the Illuminate Processor is queued before the GeoIP Resolver, as shown. If this is not the case, then select "Update" to reorder your processing steps.

Then, on the same page, locate the geolocation configuration under the Plugins section.

Geolocation_4.3_1

Here, select "Update" to configure your plugin utilizing either MaxMind or IPInfo. In the configuration dialog, you need to select "Enable Geo-location processor" and enter the paths to both the city and ASN databases you use. Once you are all set, click on save to store the configuration changes.

Geolocation_4.3_2

Additionally, as of 4.3, you can select "Enforce default Graylog scheme" to enable the processor only for fields in our Graylog Schema and Graylog Illuminate. This maintains enriched geolocation data usability across all content created by Graylog in the future. The Graylog specific schema fields that will be searched are: source_ip, host_ip, and destination_ip. For more information regarding the Graylog Schema, see the Graylog Information Model Schema guide.

Visualize Geolocations in a Map

Graylog can display maps from geolocation stored in any field, as long as the geo-points are using the latitude,longitude format.

Display a map in the search results page

On any search result page, you can expand the field you want to use to draw a map in the search sidebar, and click on the World Map link. That will show a map with all different points stored in that field.

geolocation7.png

Add map to a dashboard

You can add the map visualization into any dashboards as you do with other widgets. Once you displayed a map in the search result page, click on Add to dashboard, and select the dashboard where you want to add the map.

geolocation8.png
geolocation9.png


Was this article helpful?