...
Displays the city name extracted from the IP address in the specified IP columncolumn in each event.
Syntax
city [IP_address_column_name]
...
* log.access | city IPaddress1
For all events For each event in log access, extracts the city name from the IP address in column IPaddress1.