Developer Builds Offline Python Pipeline to Enrich Nginx Logs with IP and ASN Data

A developer created a lightweight Python pipeline that parses Nginx access logs to generate country and ASN traffic reports without adding geolocation calls to the live request path. The tool extracts unique public IP addresses from standard combined-format logs, filters out private and loopback ranges, and batches lookups through an external geolocation API after log rotation. A SQLite cache with a seven-day expiry reduces redundant API calls, since the same IP addresses tend to recur across daily logs. The pipeline outputs results in CSV format and runs independently from the web application, so any failures do not affect live traffic. The approach avoids the latency and reliability risks of inline geolocation middleware while still giving operators visibility into whether traffic spikes originate from customers, cloud providers, or unexpected networks.