Hi, I was going through the process of setting up the ip_lookups enrichment. Even though I’ll end up subscribing to maxmind but just for fun I wondered if there was another way to do it using AWS Cloudfront’s CloudFront-Viewer-Country header that gets forwarded by the edge server. I only need country level detection.
You’d have to put the collector behind CloudFront and make sure to pass all traffic through. It might not be necessary to enable all edge locations. Then I suppose use the HTTP Header enrichment to extract the header.
That’s…really interesting. I’d considered using edge node location before but it has the problem of not being accurate enough because of network considerations and the fact that there’s just not enough edge nodes to reliably locate down to the country level.
The header solution sounds neat as a bit of fun but I suspect it’s only as accurate as Maxmind which sounds like what AWS is using.