GeoIP

Configuration Options

Required Options

database(required)

Path to the MaxMind GeoIP2 or GeoLite2 binary city database file (GeoLite2-City.mmdb). Other databases, such as the the country database, are not supported.

TypeSyntaxDefaultExample
stringliteral["/path/to/GeoLite2-City.mmdb","/path/to/GeoLite2-ISP.mmdb"]
source(required)

The field name that contains the IP address. This field should contain a valid IPv4 or IPv6 address.

TypeSyntaxDefaultExample
stringliteral["ip_address","x-forwarded-for","parent.child","array[0]"]
inputs(required)

A list of upstream source or transform IDs. Wildcards (*) are supported.

See configuration for more info.

TypeSyntaxDefaultExample
arrayliteral["my-source-or-transform-id","prefix-*"]
type(required)

The component type. This is a required field for all components and tells Vector which component to use.

TypeSyntaxDefaultExample
stringliteral["geoip"]

Advanced Options

target(optional)

The default field to insert the resulting GeoIP data into. See output for more info.

TypeSyntaxDefaultExample
stringliteralgeoip["geoip","parent.child"]

How it Works

Supported MaxMind databases

The geoip transform currently supports the following MaxMind databases:

  • GeoLite2-ASN.mmdb (free) — Determine the autonomous system number and organization associated with an IP address.
  • GeoLite2-City.mmdb (free) — Determine the country, subdivisions, city, and postal code associated with IPv4 and IPv6 addresses worldwide.
  • GeoIP2-City.mmdb (paid) — Determine the country, subdivisions, city, and postal code associated with IPv4 and IPv6 addresses worldwide.
  • GeoIP2-ISP.mmdb (paid) — Determine the Internet Service Provider (ISP), organization name, and autonomous system organization and number associated with an IP address.

The database files should be in the MaxMind DB file format.

State

This component is stateless, meaning its behavior is consistent across each input.