From 39da36361c4479be3d01b891953589132d00a198 Mon Sep 17 00:00:00 2001
From: AlteredCoder <64792091+AlteredCoder@users.noreply.github.com>
Date: Tue, 12 Jul 2022 15:26:34 +0200
Subject: [PATCH] Get geoip Country from other objects if not present (#1659)

---
 pkg/parser/enrich_geoip.go | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/pkg/parser/enrich_geoip.go b/pkg/parser/enrich_geoip.go
index bb9dcc401..baf295a43 100644
--- a/pkg/parser/enrich_geoip.go
+++ b/pkg/parser/enrich_geoip.go
@@ -77,8 +77,20 @@ func GeoIpCity(field string, p *types.Event, ctx interface{}) (map[string]string
 		log.Debugf("Unable to enrich ip '%s'", ip)
 		return nil, nil
 	}
-	ret["IsoCode"] = record.Country.IsoCode
-	ret["IsInEU"] = strconv.FormatBool(record.Country.IsInEuropeanUnion)
+	if record.Country.IsoCode != "" {
+		ret["IsoCode"] = record.Country.IsoCode
+		ret["IsInEU"] = strconv.FormatBool(record.Country.IsInEuropeanUnion)
+	} else if record.RegisteredCountry.IsoCode != "" {
+		ret["IsoCode"] = record.RegisteredCountry.IsoCode
+		ret["IsInEU"] = strconv.FormatBool(record.RegisteredCountry.IsInEuropeanUnion)
+	} else if record.RepresentedCountry.IsoCode != "" {
+		ret["IsoCode"] = record.RepresentedCountry.IsoCode
+		ret["IsInEU"] = strconv.FormatBool(record.RepresentedCountry.IsInEuropeanUnion)
+	} else {
+		ret["IsoCode"] = ""
+		ret["IsInEU"] = strconv.FormatBool(false)
+	}
+
 	ret["Latitude"] = fmt.Sprintf("%f", record.Location.Latitude)
 	ret["Longitude"] = fmt.Sprintf("%f", record.Location.Longitude)