You can use the geoip plugin in LogCollector to convert IP addresses to geographic locations, including country, province, city, latitude and longitude.

Notice

This plugin is supported in LogCollector V2.3.0 and later versions. To check your LogCollector version, see 2. View software version.

Parameters description

Name

Type

Required

Description

Name	Type	Required	Description
field	String	Yes	The log field for IP address conversion.
mmdb_path	String	Yes	GeoIP database path.
language	String	No	Language attribute. The default is zh-CN.
city_field	String	No	The field for storing city information. The default is city.
province_field	String	No	The field for storing province information. It defaults to province.
country_field	String	No	The field for storing country information. It defaults to country.
longitude_field	String	No	Field for storing longitude information. It defaults to longitude.
latitude_field	String	No	Field for storing latitude information. It defaults to latitude.
allow_empty_values	Boolean	No	After parsing the specified field value in field, if any subfield is empty, this parameter determines whether to keep the key-value pair. true: keep it. false (default): do not keep it.
allow_overwrite_keys	Boolean	No	If the key specified in keys duplicates an existing key in the collection configuration, this parameter determines whether to overwrite the field corresponding to the existing key. true: overwrite. false (default): If the key is duplicated, LogCollector plugin configuration execution will fail.

Configuration examples

raw logs

"ip" : "**.**.**.**"

Plugin configuration for LogCollector

{
"processors": [
{
"geoip": {
"field": "ip",
"mmdb_path": "/usr/local/data/GeoLite2-City_20181002/GeoLite2-City.mmbd",
}
}
]
}

Processing result

"ip": "**.**.**.**
"city": "Beijing"
"province": "BJ"
"country": "CN"
"longitude": "116.********"
"latitude": "40.********"

Last updated: 2025.12.12 10:30:52

Public security network record in Beijing: No. 11010802032137