Python3 script to geo-locate fail2ban logs and then JSONify the data. NOTE: Depends on the command 'geoiplookup'

fail2ban2geo.py

#!/usr/bin/python3
import json
import subprocess

logFile = '/var/log/fail2ban.log'

banList = []
banListGeo = {}

with open(logFile) as f:
    content = f.readlines()
    
    for line in content:
        if 'Ban' in line:
            fields = line.strip().split()
            banList.append(fields[7])
            result = subprocess.run(["geoiplookup", fields[7]], stdout=subprocess.PIPE)
            country = result.stdout.strip().split()[4].decode("utf-8")
            if country not in banListGeo:
                banListGeo[country] = 1
            else:
                banListGeo[country] += 1
print(json.dumps(banListGeo))