I Turned Nginx Access Logs into an IP and ASN Traffic Report

I Turned Nginx Access Logs into an IP and ASN Traffic Report

Raw Nginx logs told me which endpoints were busy, but not whether a traffic spike came from customers, a cloud provider, or one unexpected network. I built a small enrichment job that turns unique public IPs into a country and ASN report without putting geolocation calls in the request path.

The IP Geolocation Lookup does the lookup, and the rest is a local Python pipeline with parsing, deduplication, caching, and deliberately boring CSV output.

Start with offline enrichment

Calling a geolocation API from Nginx middleware adds latency and creates a new failure mode for every request. Access logs already contain what the report needs, so the job can run after rotation and fail independently from the application.