0ct0pu5/crowdsec
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Get geoip Country from other objects if not present (#1659)

Browse source
This commit is contained in:
AlteredCoder 2022-07-12 15:26:34 +02:00 • committed by GitHub
parent 73f336363a
commit 39da36361c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
pkg/parser/enrich_geoip.go
View file

@ -77,8 +77,20 @@ func GeoIpCity(field string, p *types.Event, ctx interface{}) (map[string]string
log.Debugf("Unable to enrich ip '%s'", ip)
return nil, nil
}
ret["IsoCode"] = record.Country.IsoCode
ret["IsInEU"] = strconv.FormatBool(record.Country.IsInEuropeanUnion)
if record.Country.IsoCode != "" {
ret["IsoCode"] = record.Country.IsoCode
ret["IsInEU"] = strconv.FormatBool(record.Country.IsInEuropeanUnion)
} else if record.RegisteredCountry.IsoCode != "" {
ret["IsoCode"] = record.RegisteredCountry.IsoCode
ret["IsInEU"] = strconv.FormatBool(record.RegisteredCountry.IsInEuropeanUnion)
} else if record.RepresentedCountry.IsoCode != "" {
ret["IsoCode"] = record.RepresentedCountry.IsoCode
ret["IsInEU"] = strconv.FormatBool(record.RepresentedCountry.IsInEuropeanUnion)
} else {
ret["IsoCode"] = ""
ret["IsInEU"] = strconv.FormatBool(false)
}
ret["Latitude"] = fmt.Sprintf("%f", record.Location.Latitude)
ret["Longitude"] = fmt.Sprintf("%f", record.Location.Longitude)