GeoIP map visualization

The end goal: map of IPs
Nginx visitors visualized on a World Map
Step-by-step instructions
1. Add a source that logs IP addresses
We're going to use our Nginx logs that are automatically collected when using the Ubuntu source. Nginx stores client IP addresses in the client_string column, e.g client_string="162.158.94.153"
Most of our integrations record client IP addresses automatically.
2. Create a new Grafana dashboard
Add a new Panel in your Grafana dashboard of choice.
3. Add the GeoIP query to the Grafana panel
Replace client_string by a different column name if you're not using our Ubuntu/Nginx integration for this tutorial. We're also including AND file_string LIKE '%nginx%' to include only our Nginx logs, since the Ubuntu integration aggregates multiple services.
SELECT
    (case when length(city_name) == 0 then 'unknown' else city_name end) AS name,
    latitude, longitude,
    count() AS metric
​
FROM $table
LEFT SEMI JOIN geoip.city_ipv4 
    ON geoip.city_ipv4.geoname_id = dictGetUInt32('geoip.city_ipv4_dictionary', 'geoname_id', tuple(IPv4StringToNum(assumeNotNull(client_string))))
JOIN geoip.city_locations ON toUInt32(geoip.city_locations.geoname_id) = geoip.city_ipv4.geoname_id
WHERE $timeFilter
AND client_string IS NOT NULL
AND file_string LIKE '%nginx%'
​
GROUP BY latitude, longitude, city_name
4. Select "Format as: Table" in the bottom panel settings
This is necessary for the Worldmap panel to properly pick up the data.
5. Select the "Worldmap" visualization
This setting can be found in the right-hand side menu of the Grafana dashboard.
6. Tweak Worldmap settings
Modify the panel settings for an optimal experience:
Map Visual Options (optional)
Min circle size: 1 
Max circle size: 30 
Map Data Options
Location Data: table
Aggregation: current
Field Mapping
Table Query Format: coordinates
Location Name Field: name
Metric Field: metric (default)
Latitude Field: latitude (default)
Longitude Field: longitude (default)
Threshold Options (optional)
Thresholds: 10,100 (base this on the volume of your visits)
7. Done!
You should see your visitors on a World Map. 
Tweak the Map Visual Options and Threshold Options to modify your map.
Nginx visitors visualized on a World Map
Need help with your report? Let us know at [email protected].

How-to Guides - Previous

Deprecated tables in Logtail

Next - How-to Guides

AWS S3-compatible archive

Last modified 1yr ago

Copy link

On this page

The end goal: map of IPs

Step-by-step instructions

1. Add a source that logs IP addresses

2. Create a new Grafana dashboard

3. Add the GeoIP query to the Grafana panel

4. Select "Format as: Table" in the bottom panel settings

5. Select the "Worldmap" visualization

6. Tweak Worldmap settings

7. Done!