The ipLocation() function adds geolocation data for IPv4 or IPv6 addresses. It adds the following 4 fields (attributes) to the events (ip prefix is default): ip.country, ip.city, ip.lon, and ip.lat.

LogScale includes GeoLite2 data created by MaxMind. By default, the database is automatically updated if the cluster is running with a valid LogScale license.

Note

Updates to the MaxMind database are checked every 5 minutes.

Only the paid version of the MaxMind database includes city information as well as country information. Some IP addresses only show country information regardless of the MaxMind database version used, in case the city information is unknown.

Note

For self-hosted customers, in order to use your own MaxMind database, place it in the LogScale data directory as IpLocationDb.mmdb and run LogScale with environment variable AUTO_UPDATE_IP_LOCATION_DB set to false. Ensure that the database includes city information (for example, GeoLite2 City). For more information, see MaxMind Configuration.

ParameterTypeRequiredDefault ValueDescription
asstringoptional[a]   Name the prefix to add to fields added by the ipLocation function. Defaults to . (the name of the field from which to get the IP address).
field[b]stringoptional[a] ip The field from which to get the IP address.

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

ipLocation() Syntax Examples

Based on the field ip, the attributes ip.country, ip.city, ip.lon and ip.lat are added to the event. The default field is ip.

logscale
ipLocation()

Based on the field address, the attributes address.country, address.city, address.lon and address.lat are added to the event. The field parameter is used in the following example:

logscale
ipLocation(field=address)

Based on the field ip, the attributes address.country, address.city, address.lon and address.lat are added to the event. The as parameter is used in the following example:

logscale
ipLocation(as=address)

ipLocation() Examples

Click + next to an example below to get the full details.

Retrieve Location Data From Specified Field

Retrieve location data from a specified field using the ipLocation() function