Feature: World / Geo map panel for custom dashboards (GeoIP)

[SemoTech]

Problem

Self-hosted / WAN reverse-proxy users (Caddy, nginx, Traefik) often want a geography view of inbound clients: where in the world traffic to exposed hostnames is coming from.

LogTide already has:

• GeoIP enrichment via parsing pipelines (embedded GeoLite2 → country, city, coordinates, ISP)
• Custom dashboards with time series, Top-N, live stream, stats, etc.

What is missing is a first-class map panel on custom dashboards so GeoIP coordinates can be plotted (e.g. flat/equirectangular world map with dots or heat for hit volume).

Today, maps appear mainly in SIEM incident detail views, not as a composable dashboard widget. Teams fall back to Top-N by country or export to Grafana GeoMap.

Proposal

Add a dashboard panel type, e.g. Geo map / World map:

1. Data source: logs (project-scoped), using GeoIP lat/lon (or country centroids as fallback)
2. Visual: flattened / equirectangular world map (dark/light friendly)
3. Encoding: point size or heat by hit count; optional color by http_status / severity
4. Filters: same as other panels (time range, service, host, query string)
5. Tooltip / side panel: source IP, city, country, target host, status, hit count, last seen
6. Companion: works well next to existing Top-N tables (top countries, top hosts, top IPs)

Why it fits LogTide

• Complements pipelines GeoIP (enrich once → visualize many places)
• High value for edge / self-hosted reverse-proxy and SIEM-ish WAN monitoring
• Panel registry is already designed for new types (shared types + fetcher + Svelte panel)

Alternatives considered

• Top-N by country only (useful, but not spatial)
• Grafana GeoMap beside LogTide (works, but splits the UX)
• Incident-only maps (too late / too narrow for routine WAN ops dashboards)

Additional context

Happy to help refine UX (flat map vs globe, clustering at zoom levels, etc.). Related: custom dashboards + GeoIP pipelines from 0.9.x.