Heka Message Extensions with GeoIP Information

This module is intended to be used with another IO module such as a decoder to extend the message with GeoIP information prior to injection.

1. Functions

1.1. add_geoip

Given a Heka message add the geoip entries based on the specified field name. The requested geoip entries are specified in the lookup configuration table. The table consists of the entry name and the suffix to add to the field name, an empty suffix will overwrite the original value. See: the opts variable in https://github.com/agladysh/lua-geoip/blob/master/src/city.c for the available options, common values include "city" and "country_code".

For example, if "remote_addr" is present in msg.Fields with a cfg of lookup = { city = "_city" } on a successful lookup a new field will be added to the message named "remote_addr_city" with the resulting city value.

Arguments

  • msg (table) - original message
  • field_name (string) - field name in the message to lookup

Return

  • none - the message is modified in place or an error is thrown

2. Configuration examples

geoip_heka = {
    city_db_file = "/path/to/geo/dat", -- path to GeoIP data
    lookup = { city = "_city", country_code = "_country" }, -- entries to lookup and their field suffix
    remove_original_field = false, -- remove the original field after a successful lookup

    test = false, -- true if being used in tests without GeoIP database
}

source code: heka.lua

results matching ""

    No results matching ""