# \_geoip\_lookup\_failure

**URL:** <https://discuss.elastic.co/t/-geoip-lookup-failure/78873>\
**Category:** Logstash\
**Created:** [March 16, 2017, 1:59pm UTC](https://discuss.elastic.co/t/-geoip-lookup-failure/78873 "2017-03-16T13:59:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![m.francia](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@m.francia](https://discuss.elastic.co/u/m.francia)\
**Post date:** [March 16, 2017, 1:59pm UTC](https://discuss.elastic.co/t/-geoip-lookup-failure/78873/1 "2017-03-16T13:59:06Z")

</div>

Hi!

I have this grok pattern:

```
RTMPLOGV %{IPORHOST:ipclient} \[%{HTTPDATE:timestamp}\] %{WORD:command} "%{GREEDYDATA:app}" "%{WORD:name}" %{DATA} %{NUMBER:bytesreceived} %{NUMBER:bytessent} "%{URI:url}" "%{HOSTNAME:flashhost} %{GREEDYDATA:flashversion}" %{TIMEVISION:timevision}
TIMEVISION ([(]?%{MONTHDAY:days}d)?([(]?%{HOUR:hours}h)?([(]?%{BASE10NUM:mins}m)?[(]?% {BASE10NUM:secs}s[)] 

```

For this log:

```
111.111.111.111 [24/Oct/2016:18:46:00 +0200] PLAY "x-mix" "live" "" - 480 207101 "https://x.es/x" "WIN 23,0,0,185" (7s)

```

My logstash filter is:

```
filter {
	if [type] == "rmtp"{
    grok {
      patterns_dir => ["patterns.grok"]
      match => { "message" => "%{RTMPLOGV}" }
    }
  }
  date {                         
        match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]
        timezone => "Europe/Madrid"
        target => "@timestamp"
  }
  geoip{
  	source => "ipclient"
  }
}

```

And the logstash console return this:

```
{
          "path" => "C:\\Users\\user\\Desktop\\rtmp.log",
    "@timestamp" => 2017-03-16T13:51:55.394Z,
         "geoip" => {},
      "@version" => "1",
          "host" => "RS-000064",
       "message" => "111.111.111.111 [24/Oct/2016:18:46:00 +0200] PLAY \"x-mi
x\" \"live\" \"\" - 480 207101 \"https://x/x\" \"WIN 23,0,0,185\" (
7s)\r",
          "type" => "rtmp",
          "tags" => [
        [0] "_geoip_lookup_failure"
    ]
}

```

Why?

Thanks in advance 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2017, 1:59pm UTC](https://discuss.elastic.co/t/-geoip-lookup-failure/78873/2 "2017-04-13T13:59:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.