howto use geoip via vrl

[tshepang]

I have this bit of vrl

.geoip = get_enrichment_table_record!(
  table: "geoip",
  condition: {"ip": .srcip}
)

I also set these globals

enrichment_tables.geoip.path = "/var/lib/GeoLite2-City.mmdb"
enrichment_tables.geoip.type = "geoip"

I get no output, even though I have events with srcip fields.
Am I missing something? What does condition mean... are there some examples you can share?

vector 0.24.0 (x86_64-unknown-linux-gnu 43267b9 2022-08-30)

[jszwedko]

Hi @tshepang ! What you have there looks right to me. If it failed to find a row, it should throw an error which you would see in the logs.

Would you want to open a full bug report including config, minimal reproducible example, etc. if you aren't able to get it working?

[tshepang]

I may do that.

What does condition mean, and the field "ip"? It's not so clear from the docs. Are there examples I can look at (didn't find anything in the repo)?

[jszwedko]

Hi @tshepang ! What you have is correct for the condition. This is mentioned in the docs here: https://vector.dev/docs/reference/vrl/functions/#get_enrichment_table_record . You are right that we could add another full example for it.

[Jacq]

I deployed a setup with vector and the geoip transform some months ago and forget about it. So now having to migrate to the VRL remap took me a little.

Here is my working configs, my old geoip transform config and the new VRL one, I provide them just in case it clarifies you problem and eases the migration path for others. It would nice to include in the 0.26v migrate documentation a similar example.

Migrating from old deprecated geoip transform, 'ip_address' contains the IP address field to enrich and geoip is populated with the associated geoip info:

transforms:
  geoip:
    type: geoip
    inputs:
      - with_ip_info
    database: /etc/vector/GeoLite2-City.mmdb
    source: ip_address
    target: geoip

Using VRL remap and enrichment tables:

enrichment_tables:
  geoip_table:
    path: /etc/vector/GeoLite2-City.mmdb
    type: geoip
 
transforms: 
  geoip:
    type: remap
    inputs:
      - with_ip_info
    source: |-
      .geoip = get_enrichment_table_record!("geoip_table",
        {
          "ip": .ip_address
        }

Cheers,
Jacq

[jszwedko]

Thanks @Jacq ! I opened #15475 to add this example migration to the upgrade guide.