Skip to content

Attach your own MaxMind database

You already use geo lookups for custom zones (see Geolocation lookups). If you have a MaxMind DB file (.mmdb) with your own columns, you can enrich IP fields the same way: put the file where Parsec can find it, then add a short enricher declaration.

Ask an administrator if you are unsure where files are stored on the server. You do not need to rebuild parsers in code.

What you need

  1. An .mmdb file (GeoLite, GeoIP, or a custom MaxMind DB with your attributes).
  2. A group name for the folder (often geo, same as public geo enrichment).
  3. The attributes from the DB that you want on the event (for example city name or a custom score).
  4. Matching fields in the event schema (usually ECS), so Discover and dashboards can store them.

1. Place the database file

Copy the .mmdb into the lookups folder for your group, for example:

/lookups/geo/my-custom.mmdb

Use the same group name in the enricher below. Tenant specific folders are possible; your administrator can confirm the layout.

2. Add an enricher declaration

In the Library, under the parser path for the log source (next to other enrichers), add a YAML file, for example 55_enricher_maxmind.yaml:

define:
  type: enricher/ip
  group: geo

schema:
  /Schemas/ECS.yaml:
    mapping:
      city_name: "{entity}.geo.city_name"
      country.iso_code: "{entity}.geo.country_iso_code"

What this means in plain language:

  • group: geo loads every .mmdb (and other geo lookup files) from the geo folder.
  • mapping says: take this attribute from the database and write it to this field on the event.
  • {entity} is replaced by source, destination, client, and so on, depending on which IP field was looked up.

Example: for source.ip, city_name becomes source.geo.city_name.

Optional: simple naming without a mapping table

If your database attribute names already match the ECS suffix (for example city_name → source.geo.city_name), you can use a postfix instead of listing every field:

define:
  type: enricher/ip
  group: geo

schema:
  /Schemas/ECS.yaml:
    postfix: geo.

Use mapping when names differ or when you want full control. Use postfix when names already line up.

3. Event schema fields

Make sure the target fields exist in your schema (Library → Schemas), for example:

  • source.geo.city_name
  • source.geo.country_iso_code
  • destination.geo.city_name
  • and any custom fields you mapped

If a field is missing from the schema, enrichment for that attribute is skipped.

4. Check the result

  1. Save the enricher and wait for Parsec to reload (or ask ops to reload the parser).
  2. Send or wait for an event that has source.ip (or another IP field) covered by your database.
  3. In Discover, open the event and look for the new *.geo.* (or your mapped) fields.

Tips

  • Start with one or two mapped attributes, then add more.
  • Keep custom data in the same geo group only if that is what you want; otherwise use another group name and the same group in the enricher.
  • Empty values from the database are not written onto the event.
  • For IP ranges you maintain yourself in the UI (zones, offices), keep using Geolocation lookups. MaxMind files are for ready made or vendor databases.