Hello ,
I am using Promtail to ingest Loki some OpenVpn from syslog-ng to Loki
i am using GeoIP stages as following
- match:
selector: '{job="syslog"}'
stages:
- regex:
expression: '^(?P<time>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}\+\d{2}:\d{2})\s(?P<source_fw>.+?)\s(?P<auth_source>.+?)\s(\d+?)\s-\s-\s(?P<user_name>.+?)\/(?P<client_ip>[\d.]+):\d+\speer\sinfo\:\sIV_VER=\d\..+'
- geoip:
db: "/siem_folder/promtail/GeoLite2-City.mmdb"
source: client_ip
db_type: "city"
The fields are looks as follows below in Grfana (Grafana v9.5.2) , i am trying to set worldmap or a geomap panel for username world connection but i cant set the it correctly
sum by (geoip_country_name) (count_over_time({job="syslog",user_name!=""} | json | geoip_country_name != "" [5m]))
in the panel settings i got
Country Code (not found)
Any idea how i should set it correctly ,
Please advice
Thanks