Enrich Elasticsearch Logs With GeoIP at Ingest
An access log full of raw IPs can't answer where a traffic spike came from. Elasticsearch GeoIP fixes that at write time, enriching public-IP events with whatever country, region, city, and coordinate data is available so queries, alerts, and dashboards downstream can use geography directly. This guide sets up that enrichment in an ingest pipeline, fixes the two things that silently break it, and…
Elasticsearch's built-in GeoIP enrichment processor allows access logs with raw IP addresses to be enhanced with geographical data such as country, region, city, and coordinates. This guide outlines the process of setting up this enrichment in an ingest pipeline, resolving common issues that may arise during implementation. By leveraging the GeoLite2 databases provided by MaxMind, the geoip processor enriches documents in real-time, enabling queries, alerts, and dashboards to utilize geographical information directly.
To utilize the processor, no additional plugins are required, as it ships with Elasticsearch by default. This approach is applicable to modern Elasticsearch 8.x and 9.x clusters with security enabled. The processor automatically downloads and updates the free MaxMind GeoLite2 databases. The enrichment process is initiated within an ingest pipeline, which is a collection of processors that operate on documents prior to indexing.
A sample document is tested using the _simulate API before applying the pipeline to real data. Kibana will display a map populated with geographical data only if the location field is mapped as geo_point in the index template.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
