GilbN / geoip2influx

A python script that will parse the nginx access.log and send geolocation metrics and log metrics to InfluxDB
MIT License
73 stars 15 forks source link

Unknown city : stat ignored #10

Closed emmanuelvargas closed 2 years ago

emmanuelvargas commented 2 years ago

Hello

thank for your mod this is really helpfull :)

I have a little issue I don't know if it's a feature or a bug: sometime I have the country but not the city. The log is pushed into the influxdb no problem. But in the dashboard all the lines with no cities seems to be ignored.

Example with an IP for France :

In access.geoip.log

109.236.192.1 - - [10/Jan/2022:12:24:45 +0100]"GET /index.php/about/ HTTP/2.0" 200 9023"-" devnull.crapules.com "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36""0.091" "0.000""-" "FR"
109.236.192.1 - - [10/Jan/2022:12:24:45 +0100]"GET /favicon.ico HTTP/2.0" 302 0"https://devnull.crapules.com/index.php/about/" devnull.crapules.com "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36""0.068" "0.000""-" "FR"

seems to be well pushed into influxdb:

GEOIP2INFLUX 10/Jan/2022 12:24:45 :: DEBUG :: Geo metrics: [{'tags': {'geohash': 'u09tvnqgxst5', 'ip': '109.236.192.1', 'host': '1aa1bc406889', 'country_code': 'FR', 'country_name': 'France', 'state': None, 'state_code': None, 'city': None, 'postal_code': None, 'latitude': 48.8582, 'longitude': 2.3387}, 'fields': {'count': 1}, 'measurement': 'geoip2influx'}]
GEOIP2INFLUX 10/Jan/2022 12:24:45 :: DEBUG :: http://MyIP:8086 "POST /write?db=mydb HTTP/1.1" 204 0
GEOIP2INFLUX 10/Jan/2022 12:24:45 :: DEBUG :: NGINX log metrics: [{'tags': {'ip': '109.236.192.1', 'datetime': datetime.datetime(2022, 1, 10, 12, 24, 45, tzinfo=datetime.timezone(datetime.timedelta(seconds=3600))), 'remote_user': '-', 'method': 'GET', 'referrer': '/index.php/about/', 'host': 'devnull.crapules.com', 'http_version': 'HTTP/2.0', 'status_code': '200', 'bytes_sent': '9023', 'url': '-', 'user_agent': 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36', 'request_time': '0.091', 'connect_time': '0.000', 'city': '-', 'country_code': 'FR', 'country_name': 'France'}, 'fields': {'count': 1, 'bytes_sent': 9023, 'request_time': 0.091, 'connect_time': 0.0}, 'measurement': 'nginx_access_logs'}]
GEOIP2INFLUX 10/Jan/2022 12:24:46 :: DEBUG :: http://MyIP:8086 "POST /write?db=mydb HTTP/1.1" 204 0
GEOIP2INFLUX 10/Jan/2022 12:24:46 :: DEBUG :: Geo metrics: [{'tags': {'geohash': 'u09tvnqgxst5', 'ip': '109.236.192.1', 'host': '1aa1bc406889', 'country_code': 'FR', 'country_name': 'France', 'state': None, 'state_code': None, 'city': None, 'postal_code': None, 'latitude': 48.8582, 'longitude': 2.3387}, 'fields': {'count': 1}, 'measurement': 'geoip2influx'}]
GEOIP2INFLUX 10/Jan/2022 12:24:46 :: DEBUG :: http://MyIP:8086 "POST /write?db=mydb HTTP/1.1" 204 0
GEOIP2INFLUX 10/Jan/2022 12:24:46 :: DEBUG :: NGINX log metrics: [{'tags': {'ip': '109.236.192.1', 'datetime': datetime.datetime(2022, 1, 10, 12, 24, 45, tzinfo=datetime.timezone(datetime.timedelta(seconds=3600))), 'remote_user': '-', 'method': 'GET', 'referrer': '/favicon.ico', 'host': 'devnull.crapules.com', 'http_version': 'HTTP/2.0', 'status_code': '302', 'bytes_sent': '0', 'url': 'https://devnull.crapules.com/index.php/about/', 'user_agent': 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36', 'request_time': '0.068', 'connect_time': '0.000', 'city': '-', 'country_code': 'FR', 'country_name': 'France'}, 'fields': {'count': 1, 'bytes_sent': 0, 'request_time': 0.068, 'connect_time': 0.0}, 'measurement': 'nginx_access_logs'}]
GEOIP2INFLUX 10/Jan/2022 12:24:46 :: DEBUG :: http://MyIP:8086 "POST /write?db=mydb HTTP/1.1" 204 0

Into my grafana dashboard the country FR don't appear :

image

If i'm editing the request (sorry i'm not a Grafana specialist) and remove the "city" filter I can see the data is present :

image

Sorry I probably miss something into the grafana dashboard

Thank you!

GilbN commented 2 years ago

Hello

thank for your mod this is really helpfull :)

I have a little issue I don't know if it's a feature or a bug: sometime I have the country but not the city. The log is pushed into the influxdb no problem. But in the dashboard all the lines with no cities seems to be ignored.

Example with an IP for France :

In access.geoip.log

109.236.192.1 - - [10/Jan/2022:12:24:45 +0100]"GET /index.php/about/ HTTP/2.0" 200 9023"-" devnull.crapules.com "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36""0.091" "0.000""-" "FR"
109.236.192.1 - - [10/Jan/2022:12:24:45 +0100]"GET /favicon.ico HTTP/2.0" 302 0"https://devnull.crapules.com/index.php/about/" devnull.crapules.com "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36""0.068" "0.000""-" "FR"

seems to be well pushed into influxdb:

GEOIP2INFLUX 10/Jan/2022 12:24:45 :: DEBUG :: Geo metrics: [{'tags': {'geohash': 'u09tvnqgxst5', 'ip': '109.236.192.1', 'host': '1aa1bc406889', 'country_code': 'FR', 'country_name': 'France', 'state': None, 'state_code': None, 'city': None, 'postal_code': None, 'latitude': 48.8582, 'longitude': 2.3387}, 'fields': {'count': 1}, 'measurement': 'geoip2influx'}]
GEOIP2INFLUX 10/Jan/2022 12:24:45 :: DEBUG :: http://MyIP:8086 "POST /write?db=mydb HTTP/1.1" 204 0
GEOIP2INFLUX 10/Jan/2022 12:24:45 :: DEBUG :: NGINX log metrics: [{'tags': {'ip': '109.236.192.1', 'datetime': datetime.datetime(2022, 1, 10, 12, 24, 45, tzinfo=datetime.timezone(datetime.timedelta(seconds=3600))), 'remote_user': '-', 'method': 'GET', 'referrer': '/index.php/about/', 'host': 'devnull.crapules.com', 'http_version': 'HTTP/2.0', 'status_code': '200', 'bytes_sent': '9023', 'url': '-', 'user_agent': 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36', 'request_time': '0.091', 'connect_time': '0.000', 'city': '-', 'country_code': 'FR', 'country_name': 'France'}, 'fields': {'count': 1, 'bytes_sent': 9023, 'request_time': 0.091, 'connect_time': 0.0}, 'measurement': 'nginx_access_logs'}]
GEOIP2INFLUX 10/Jan/2022 12:24:46 :: DEBUG :: http://MyIP:8086 "POST /write?db=mydb HTTP/1.1" 204 0
GEOIP2INFLUX 10/Jan/2022 12:24:46 :: DEBUG :: Geo metrics: [{'tags': {'geohash': 'u09tvnqgxst5', 'ip': '109.236.192.1', 'host': '1aa1bc406889', 'country_code': 'FR', 'country_name': 'France', 'state': None, 'state_code': None, 'city': None, 'postal_code': None, 'latitude': 48.8582, 'longitude': 2.3387}, 'fields': {'count': 1}, 'measurement': 'geoip2influx'}]
GEOIP2INFLUX 10/Jan/2022 12:24:46 :: DEBUG :: http://MyIP:8086 "POST /write?db=mydb HTTP/1.1" 204 0
GEOIP2INFLUX 10/Jan/2022 12:24:46 :: DEBUG :: NGINX log metrics: [{'tags': {'ip': '109.236.192.1', 'datetime': datetime.datetime(2022, 1, 10, 12, 24, 45, tzinfo=datetime.timezone(datetime.timedelta(seconds=3600))), 'remote_user': '-', 'method': 'GET', 'referrer': '/favicon.ico', 'host': 'devnull.crapules.com', 'http_version': 'HTTP/2.0', 'status_code': '302', 'bytes_sent': '0', 'url': 'https://devnull.crapules.com/index.php/about/', 'user_agent': 'Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36', 'request_time': '0.068', 'connect_time': '0.000', 'city': '-', 'country_code': 'FR', 'country_name': 'France'}, 'fields': {'count': 1, 'bytes_sent': 0, 'request_time': 0.068, 'connect_time': 0.0}, 'measurement': 'nginx_access_logs'}]
GEOIP2INFLUX 10/Jan/2022 12:24:46 :: DEBUG :: http://MyIP:8086 "POST /write?db=mydb HTTP/1.1" 204 0

Into my grafana dashboard the country FR don't appear :

image

If i'm editing the request (sorry i'm not a Grafana specialist) and remove the "city" filter I can see the data is present :

image

Sorry I probably miss something into the grafana dashboard

Thank you!

Pushed a fix that might fix it.

emmanuelvargas commented 2 years ago

Perfect! Never seen a so fast fix 😄 Thanks