5
5
++++
6
6
7
7
The `ip_location` processor adds information about the geographical location of an
8
- IPv4 or IPv6 address.
8
+ IPv4 or IPv6 address. It is compatible with the GeoIP2 and GeoLite2 IP geolocation
9
+ databases available from https://www.maxmind.com/[MaxMind], as well as many of the
10
+ IP geolocation databases available from https://ipinfo.io[IPinfo].
9
11
10
12
[[ip-location-automatic-updates]]
11
13
By default, the processor uses the GeoLite2 City, GeoLite2 Country, and GeoLite2
@@ -24,8 +26,8 @@ stats API>>.
24
26
If your cluster can't connect to the Elastic GeoIP endpoint or you want to
25
27
manage your own updates, see <<manage-geoip-database-updates>>.
26
28
27
- If you would like to have {es} download database files directly from Maxmind using your own provided
28
- license key, see <<put-ip-location-database-api>>.
29
+ If you would like to have {es} download database files directly from Maxmind or IPinfo using your own
30
+ license key or access token , see <<put-ip-location-database-api>>.
29
31
30
32
If {es} can't connect to the endpoint for 30 days all updated databases will become
31
33
invalid. {es} will stop enriching documents with ip geolocation data and will add `tags: ["_ip_location_expired_database"]`
@@ -77,7 +79,20 @@ depend on what has been found and which properties were configured in `propertie
77
79
`location`, `accuracy_radius`, `country_confidence`, `city_confidence`, `postal_confidence`, `asn`, `organization_name`, `network`,
78
80
`hosting_provider`, `tor_exit_node`, `anonymous_vpn`, `anonymous`, `public_proxy`,
79
81
`residential_proxy`, `domain`, `isp`, `isp_organization_name`, `mobile_country_code`, `mobile_network_code`, `user_type`, and
80
- `connection_type`. The fields actually added depend on what has been found and which properties were configured in `properties`.
82
+ `connection_type`. The fields actually added depend on what has been found and which properties were configured in `properties`
83
+ * If the IPinfo ASN database is used, then the following fields may be added under the `target_field`: `ip`,
84
+ `asn`, `organization_name`, `network`, `domain`, `country_iso_code`, and `type`. The fields actually added depend on what
85
+ has been found and which properties were configured in `properties`. Note also that `country_iso_code` and `type` fields
86
+ are only present in the 'Standard ASN' database, not the free ASN database.
87
+ * If the IPinfo Country database is used, then the following fields may be added under the `target_field`: `ip`,
88
+ `country_iso_code`, `country_name`, `continent_code`, and `continent_name`. The fields actually added depend on what
89
+ has been found and which properties were configured in `properties`.
90
+ * If the IPinfo IP to Location database is used, then the following fields may be added under the `target_field`: `ip`,
91
+ `country_iso_code`, `region_name`, `city_name`, `timezone`, `postal_code`, and `location`. The fields actually added depend on what
92
+ has been found and which properties were configured in `properties`.
93
+ * If the IPinfo Privacy Detection database is used, then the following fields may be added under the `target_field`: `ip`,
94
+ `hosting`, `proxy`, `relay`, `tor`, `vpn`, and `service`. The fields actually added depend on what
95
+ has been found and which properties were configured in `properties`.
81
96
82
97
Here is an example that uses the default city database and adds the geographical information to the `ip_location` field based on the `ip` field:
83
98
0 commit comments