GeoIP: print country iso_code data in all logs

Help
, ,
1

Hi,

In tests with GeoIP that use libmaxminddb, when using the geoip settings in the rule according to 7.3. IP Keywords — Suricata 6.0.13 documentation blocking can be done using a geoip-database, so far so good.

I would like all logs to report the geolocation of all traffic, regardless of the action (alert, outage,…). Is there any variable in geoip that can be used to inform the country’s iso_code in all logs?

Suricata version: 6.0.13 compiled
OS: Debian

2

I known is possible with Logstash using example A sample Logstash configuration for Suricata JSON output. · GitHub, but exist something native in Suricata? Using one formater in some log by example

3

Hi,

Please submit a feature request for adding a geoip tag to Suricata log records.