How to Enrich Elasticsearch Logs With GeoIP Data at Ingest Time
Elasticsearch includes a built-in GeoIP processor that can automatically enrich log documents with geographic data — such as country, city, and coordinates — at the time of indexing. The processor uses free MaxMind GeoLite2 databases, which Elasticsearch downloads and updates automatically, requiring no manual plugin installation. Enrichment is configured through an ingest pipeline, and the _simulate API can be used to test it before applying it to live data. A critical setup step is mapping the location field as geo_point in an index template before indexing, without which Kibana maps will render empty. Private and internal IP addresses return no geo data by design, so pipelines should be configured with ignore_missing set to true to handle such events gracefully.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in