Build a Grafana Geomap of Traffic and Threat Score
A Grafana Geomap showing traffic by country and coloured by threat score takes about an hour to build. Almost none of that hour is the map. The map is a built-in panel and it does what you'd expect. The work is upstream: getting a country code and a risk score onto every log line, cheaply enough that you're not paying per request for the privilege. And if you search for this, you'll find a pile…
Building a Grafana Geomap to visualize traffic and threat scores can be achieved in about an hour, with the actual map creation taking minimal time. The built-in Geomap panel does not require any complex setup; it simply requires enriching log lines with country codes and risk scores.
The tutorial you may have found online is outdated, as the Worldmap plugin it referenced was archived in January 2025 and removed from Grafana 12 due to AngularJS dependency issues. Additionally, Promtail was removed in Loki 3.7.3, so using Alloy instead is recommended.
To get the necessary data into your log lines, you have two options. Option A involves enriching logs at the edge using an Nginx module that reads MMDB files, exposing $ip_* variables without incurring per-request costs. Choose a reliable IP geolocation service and integrate it with your Nginx configuration.
Once the log lines include the required fields, set up a pipeline consisting of Nginx, Alloy, Loki, and Grafana. Nginx tails the log, Loki stores it, and Grafana queries the data. The resulting Geomap panel will show countries colored by the highest threat score seen from that country, with circle markers sized by request volume. A country represented by a large, green area is safe, while small, red areas require attention.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
