GeoIP data in access_log Nginx

Server NGINX
1

Hello World,

I would like to know if is possible to put GeoIP data (country for
exemple)
in my log access (nginx)
I enabled the GeoIP module in my nginx (configure) and i would like to
use
the “$geoip_country_name” and “$geoip_city” in my accesslog
I tried to add the two variables in my log format (main) but without
success

log_format main
'$host $remote_addr - $remote_user [$time_local] “$request” ’
'$status $body_bytes_sent “$http_referer” ’
‘“$http_user_agent” “$http_x_forwarded_for” “$request_time”
“$upstream_cache_status” “$geoip_country_name” “$geoip_city”’;

Result :

my.domain.fr xxx.xxx.xxx.xxx - - [22/Jul/2015:17:14:21 +0200] “GET
/test.html HTTP/1.0” 404 564 “-” “Mozilla/5.0 (Windows NT 6.3; WOW64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134
Safari/537.36”
“0.001” “HIT” “-” “-”

But i would like this one :

my.domain.fr xxx.xxx.xxx.xxx - - [22/Jul/2015:17:14:21 +0200] “GET
/test.html HTTP/1.0” 404 564 “-” “Mozilla/5.0 (Windows NT 6.3; WOW64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134
Safari/537.36”
“0.001” “HIT” “FR” “Paris”

Thanks for your help,

Best regards,
Jugurtha

Posted at Nginx Forum:

2

Hello!

On Mon, Jul 27, 2015 at 05:10:22AM -0400, Jugurtha wrote:

'$host $remote_addr - $remote_user [$time_local] “$request” ’
'$status $body_bytes_sent “$http_referer” ’
‘“$http_user_agent” “$http_x_forwarded_for” “$request_time”
“$upstream_cache_status” “$geoip_country_name” “$geoip_city”’;

This is expected to work fine.

Result :

my.domain.fr xxx.xxx.xxx.xxx - - [22/Jul/2015:17:14:21 +0200] “GET
/test.html HTTP/1.0” 404 564 “-” “Mozilla/5.0 (Windows NT 6.3; WOW64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36”
“0.001” “HIT” “-” “-”

Most likely geo information is not available for some reason.
First of all I would recommend to check if appropriate GeoIP
databases are present on your system and loaded into nginx using the
geoip_country (for $geoip_country_name) and geoip_city (for
$geoip_city) configuration directives.

–
Maxim D.
http://nginx.org/

3

Hello Maxim,

Thanks for the reply, you are the best :wink:

I would like to add the GeoIP data into my log access to facilitate
processing in Kibana (ELK stack)
Maybe is not the good way because i know it possible to do this with
LogStash (GeoIP Filter), and this would reduce pressure Nginx (what do
you
think ?)

#Conf GEOIP (Load GeoIP Lib) => Downloaded on maxmind website
geoip_country /var/lib/GeoIP/GeoIP.dat;
geoip_city /var/lib/GeoIP/GeoLiteCity.dat;

#My log format
log_format main
'$host $remote_addr - $remote_user [$time_local] “$request” ’
'$status $body_bytes_sent “$http_referer” ’
‘“$http_user_agent” “$http_x_forwarded_for” “$request_time”
“$upstream_cache_status” “$gzip_ratio” “$geoip_country_code”’;

=> it works well with “$geoip_country_code”

my.domain.fr xxx.xxx.xxx.xxx - - [28/Jul/2015:14:29:38 +0200] “GET
/test.jpg
HTTP/1.0” 200 270225 “-” “Wget/1.12 (linux-gnu)” “-” “0.048” “MISS” “-”
“FR”

Merci, thanks again.
Best regards,
Jugurtha

Posted at Nginx Forum: