filter_geoip2: Allow nested lookup paths beyond depth 2

[cosmo0920]

geoip2 filter limited lookup path splitting to depth 2, which caused nested paths like 'subdivisions.0.names.en' to be truncated and fail at runtime.

This change allows unlimited nesting by using flb_utils_split(..., 8), making array-backed fields such as subdivisions accessible.

For example,
the following configuration could be broken on loading because of containing three dots:

    filters:
        - name: geoip2
          match: '*'
          database: GeoLite2-City.mmdb
          lookup_key: remote_addr
          record:
            - country   remote_addr %{country.names.zh-CN}
            - province  remote_addr %{subdivisions.0.names.en}
            - city      remote_addr %{city.names.zh-CN}

Closes #11287.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change

pipeline:
    inputs:
        - name: dummy
          dummy: '{"remote_addr": "171.217.41.222"}'

    filters:
        - name: geoip2
          match: '*'
          database: GeoLite2-City.mmdb
          lookup_key: remote_addr
          record:
            - country   remote_addr %{country.names.zh-CN}
            - province  remote_addr %{subdivisions.0.names.en}
            - city      remote_addr %{city.names.zh-CN}

    outputs:
        - name: stdout
          match: '*'

• Debug log output from testing the change

Fluent Bit v5.0.0
* Copyright (C) 2015-2025 The Fluent Bit Authors
* Fluent Bit is a CNCF graduated project under the Fluent organization
* https://fluentbit.io

______ _                  _    ______ _ _           _____  _____           _            
|  ___| |                | |   | ___ (_) |         |  ___||  _  |         | |           
| |_  | |_   _  ___ _ __ | |_  | |_/ /_| |_  __   _|___ \ | |/' |______ __| | _____   __
|  _| | | | | |/ _ \ '_ \| __| | ___ \ | __| \ \ / /   \ \|  /| |______/ _` |/ _ \ \ / /
| |   | | |_| |  __/ | | | |_  | |_/ / | |_   \ V //\__/ /\ |_/ /     | (_| |  __/\ V / 
\_|   |_|\__,_|\___|_| |_|\__| \____/|_|\__|   \_/ \____(_)\___/       \__,_|\___| \_/


[2026/01/19 18:34:28.979573000] [ info] Configuration:
[2026/01/19 18:34:28.979582000] [ info]  flush time     | 1.000000 seconds
[2026/01/19 18:34:28.979588000] [ info]  grace          | 5 seconds
[2026/01/19 18:34:28.979591000] [ info]  daemon         | 0
[2026/01/19 18:34:28.979594000] [ info] ___________
[2026/01/19 18:34:28.979597000] [ info]  inputs:
[2026/01/19 18:34:28.979600000] [ info]      dummy
[2026/01/19 18:34:28.979603000] [ info] ___________
[2026/01/19 18:34:28.979606000] [ info]  filters:
[2026/01/19 18:34:28.979608000] [ info]      geoip2.0
[2026/01/19 18:34:28.979611000] [ info] ___________
[2026/01/19 18:34:28.979614000] [ info]  outputs:
[2026/01/19 18:34:28.979617000] [ info]      stdout.0
[2026/01/19 18:34:28.979620000] [ info] ___________
[2026/01/19 18:34:28.979623000] [ info]  collectors:
[2026/01/19 18:34:28.980226000] [ info] [fluent bit] version=5.0.0, commit=9cf4c9f648, pid=51199
[2026/01/19 18:34:28.980247000] [debug] [engine] coroutine stack size: 36864 bytes (36.0K)
[2026/01/19 18:34:28.980448000] [ info] [storage] ver=1.4.0, type=memory, sync=normal, checksum=off, max_chunks_up=128
[2026/01/19 18:34:28.980618000] [ info] [simd    ] NEON
[2026/01/19 18:34:28.980623000] [ info] [cmetrics] version=1.0.6
[2026/01/19 18:34:28.980767000] [ info] [ctraces ] version=0.6.6
[2026/01/19 18:34:28.981402000] [ info] [input:dummy:dummy.0] initializing
[2026/01/19 18:34:28.981411000] [ info] [input:dummy:dummy.0] storage_strategy='memory' (memory only)
[2026/01/19 18:34:28.981421000] [debug] [dummy:dummy.0] created event channels: read=25 write=26
[2026/01/19 18:34:28.983751000] [debug] [stdout:stdout.0] created event channels: read=27 write=28
[2026/01/19 18:34:28.983989000] [ info] [output:stdout:stdout.0] worker #0 started
[2026/01/19 18:34:28.984155000] [ info] [sp] stream processor started
[2026/01/19 18:34:28.984194000] [ info] [engine] Shutdown Grace Period=5, Shutdown Input Grace Period=2
[2026/01/19 18:34:30.985643000] [debug] [task] created task=0x60f000007840 id=0 OK
[2026/01/19 18:34:30.985745000] [debug] [output:stdout:stdout.0] task_id=0 assigned to thread #0
[0] dummy.0: [[1768815269.985744000, {}], {"remote_addr"=>"171.217.41.222", "country"=>"中国", "province"=>"Sichuan", "city"=>"成都"}]
[2026/01/19 18:34:30.987400000] [debug] [out flush] cb_destroy coro_id=0
[2026/01/19 18:34:30.987592000] [debug] [task] destroy task=0x60f000007840 (task_id=0)
[2026/01/19 18:34:31.985519000] [debug] [task] created task=0x60f000007930 id=0 OK
[2026/01/19 18:34:31.985629000] [debug] [output:stdout:stdout.0] task_id=0 assigned to thread #0
[0] dummy.0: [[1768815270.987002000, {}], {"remote_addr"=>"171.217.41.222", "country"=>"中国", "province"=>"Sichuan", "city"=>"成都"}]
[2026/01/19 18:34:31.985842000] [debug] [out flush] cb_destroy coro_id=1
[2026/01/19 18:34:31.986340000] [debug] [task] destroy task=0x60f000007930 (task_id=0)
^C[2026/01/19 18:34:32] [engine] caught signal (SIGINT)
[2026/01/19 18:34:32.190470000] [ info] [input] pausing dummy.0
[2026/01/19 18:34:32.190882000] [ info] [output:stdout:stdout.0] thread worker #0 stopping...
[2026/01/19 18:34:32.191021000] [ info] [output:stdout:stdout.0] thread worker #0 stopped

• Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Bug Fixes
  • Improved GeoIP field retrieval to consider deeper nested location paths, allowing the system to surface more granular location details when available. Existing behavior and error handling are preserved.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

Increased the split limit used when parsing GeoIP key paths from 2 to 8 in the geoip2 plugin, causing up to eight path components to be considered when looking up values in the MMDB. No other control flow or error handling changed. (27 words)

Changes

Cohort / File(s)	Summary
GeoIP Path Parsing plugins/filter_geoip2/geoip2.c	Updated the split limiter from 2 to 8 when extracting key path segments, expanding the number of path components passed to MMDB value lookup.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I nudged a number, paths leap to eight,
Through MMDB branches I softly skate,
A tiny hop, a wider view,
The rabbit grins — more data true. 🥕✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: increasing split limit to allow nested lookup paths beyond depth 2 in the geoip2 filter.
Linked Issues check	✅ Passed	The change directly addresses issue #11287 by increasing the split limit from 2 to 8, enabling nested path lookups like 'subdivisions.0.names.en' to be resolved correctly.
Out of Scope Changes check	✅ Passed	The change is narrowly scoped to the specific requirement: only the split limit parameter was modified to address nested path resolution, with no unrelated alterations.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@plugins/filter_geoip2/geoip2.c`:
- Line 243: The code currently calls flb_utils_split(key, '.', 4) which limits
path depth to 4 segments; change the call to use an unbounded split by passing 0
(or the API's "no limit" sentinel) as the max_parts argument so deep nested keys
are fully split—update the use around the variable split and all logic that
iterates over the returned tokens (e.g., any loop that uses split->entries or
similar) to handle an arbitrary number of segments safely.