This topic describes the GeoIP2 parser for Decoders. This parser converts IP addresses into geographic locations, such as the country name and city where the IP address is typically found.
Available in NetWitness Platform version 11.2 or later, the GeoIP2 Parser is enabled by default for upgrades and new installations. The GeoIP2 parser provides the latest Maxmind GeoIP package and supports IPv6 addresses as well as IPv4.
To edit the GeoIP2 parser configuration:
- Go to ADMIN > Services.
- In the Administration services view, select a Log Decoder or a Decoder.
- Click the settings icon () and select View > Config. In the Parsers Configuration panel, select GeoIP2 to view and update configuration options.
- Define the IP addresses to lookup. The GeoIP2 parser enables the following IP addresses by default: ip.src, ip.dst, ipv6.src, and ipv6.dst. You can update options by using parsers.options to remove or add new IP addresses. For example, you can edit parsers.options and pass a comma-separated list of IP addresses to use as follows:
This adds a new IP address to lookup called ip.addr. However, since alias.ip does not end in .src or .dst, the parser will elect to place the GeoIP2 metadata generated in meta keys without a .src or .dst suffix. So, you would see country, city, and so on, after the alias.ip metadata.
The following table provides the full list of metadata that the GeoIP2 parser can potentially generate and indicates which metadata is or is not enabled by default:
|Enabled by Default||Not Enabled|
|country, country.src, country.dst||latdec, latdec.src, latdec.dst|
|longdec, longdec.src, longdec.dst|
|domain, domain.src, domain.dst||isp, isp.src, isp.dst|
|org, org.src, org.dst||city, city.src, city.dst|
You can enable the other metadata using the standard parser configurations.