metron-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From justinleet <>
Subject [GitHub] incubator-metron pull request #433: Metron 680: GeoLiteDatabase incorrectly ...
Date Thu, 02 Feb 2017 12:49:46 GMT
GitHub user justinleet opened a pull request:

    Metron 680: GeoLiteDatabase incorrectly using country geoname_id instead of city

    Swaps out country's geoname_id for city's geoname_id.  Both ids are the same in format
(they're the ids for the dataset).
    The only direct effect I know of from this is the Kibana dashboard uses this field for
unique locations (so changing what feeds this changes the dashboard output).  The main wrinkle
is that city can be unpopulated, even though a country exists (e.g. if an IP is just assigned
to the U.S., it may not have a city).  This isn't always true that (at least one IP range
for Japan appears to fill in Japan as the city's geoname id).
    I'm opening the PR with just the direct change, but it's definitely open to discussion
if we want to adjust.

You can merge this pull request into a Git repository by running:

    $ git pull METRON-680

Alternatively you can review and apply these changes as the patch at:

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #433
commit 8cd13f44d9c23c6355f21f46284a42ddf55885f9
Author: justinjleet <>
Date:   2017-02-01T03:07:31Z

    METRON-680: GeoLiteDatabase incorrectly using country geoname_id instead of city

commit 4d26af8a46a8f0dbd2c3b67319aaf96beda9d83c
Author: justinjleet <>
Date:   2017-02-01T13:43:34Z

    Updating tests that geo test data carries through


If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at or file a JIRA ticket
with INFRA.

View raw message