[graylog2] Re: Graylog 2.1.2 - Geo-Location

[Jochen Schalanda]

Hi,

please read the documentation again: 
http://docs.graylog.org/en/2.1/pages/geolocation.html#configure-the-message-processor

I've already quoted the relevant parts in my previous post.

You have to extract the information into separate fields. Currently 
everything is in the "message" field.

Cheers,
Jochen

On Tuesday, 7 February 2017 13:59:54 UTC+1, CTuser wrote:
>
> Here is some log for example:
>
> ---
> message
> 192.168.99.1 date=2017-02-07 time=14:56:43 devname=PrimaryFGT 
> devid=FG100D3G16814848 logid=13 type=traffic subtype=forward 
> level=notice vd=root srcip=27.214.37.81 srcport=29770 srcintf="wan1" 
> dstip=199.203.140.150 dstport=23 dstintf="wan1" sessionid=968745459 proto=6 
> action=deny policyid=0 dstcountry="Israel" srccountry="China" trandisp=noop 
> service="TELNET" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 
> appcat="unscanned" crscore=30 craction=131072 crlevel=high
>
> ---
>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/f5d97bc9-7207-43c3-945e-a23960955c59%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Graylog 2.1.2 - Geo-Location

[CTuser]

Here is some log for example:

---
message
192.168.99.1 date=2017-02-07 time=14:56:43 devname=PrimaryFGT 
devid=FG100D3G16814848 logid=13 type=traffic subtype=forward 
level=notice vd=root srcip=27.214.37.81 srcport=29770 srcintf="wan1" 
dstip=199.203.140.150 dstport=23 dstintf="wan1" sessionid=968745459 proto=6 
action=deny policyid=0 dstcountry="Israel" srccountry="China" trandisp=noop 
service="TELNET" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 
appcat="unscanned" crscore=30 craction=131072 crlevel=high

---

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/9cfee37d-218d-49db-84d6-3ede7ae8d823%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Graylog 2.1.2 - Geo-Location

[Jochen Schalanda]

Hi,

On Tuesday, 7 February 2017 13:46:47 UTC+1, CTuser wrote:
>
> Yes, of course.
> I'm getting lots of messages contain IPV4 from the FW.
>

Do they have any field that *only* contains an IPv4 address and no other 
content?

Cheers,
Jochen

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/3c4fd4a0-891a-43a2-87f0-422981ef5f90%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Graylog 2.1.2 - Geo-Location

[CTuser]

Hi Jochen,

Yes, of course.
I'm getting lots of messages contain IPV4 from the FW.


-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/e74da4c6-addb-42a4-903f-e29c2aacef86%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Graylog 2.1.2 - Geo-Location

[Jochen Schalanda]

Hi,

are there any other messages which exclusively contain an IPv4 or IPv6 
address in the "message" field?

I'll quote 
http://docs.graylog.org/en/2.1/pages/geolocation.html#configure-the-message-processor
:

That’s it, at this point Graylog will start looking for fields *containing 
> exclusively an IPv4 or IPv6 address*, and extracting their geolocation 
> into a _geolocation field. 


> Note: In case you are not sending structured logs to Graylog, you can use 
> extractors to store the IPs in your messages into their own fields. Check 
> out the Extractors documentation 
>  for 
> more information.


Cheers,
Jochen

On Tuesday, 7 February 2017 12:59:46 UTC+1, CTuser wrote:
>
>
> Hi,
>
>
> I followed 
> http://docs.graylog.org/en/2.0/pages/geolocation.html#configure-geolocation 
> in order to apply the Geo-Location feature.
> I tested it with nc -w0   <<< '8.8.8.8' and it worked.
>
>
> [image: image] 
> 
>
> I don't see another logs with "message_geolocation" , even though the 
> database path is configured.
>
> [image: image]
>
> 
>
>
>
> 
>
> In addition, it's also activate in Message Processors Configuration.
>
>
> [image: image] 
> 
>
> Please advise.
>
>- Graylog Version: 2.1.2 (Running on CentOS 7)
>- Elasticsearch Version: Don't know
>- MongoDB Version: Don't know
>- Operating System: win 10 x64
>- Browser version: FF 51.0.1
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/8a787c67-004c-4d28-81da-6ada75e0a8c7%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.