# \_geoip\_parse\_failure on logstash config
**URL:** https://discuss.elastic.co/t/-geoip-parse-failure-on-logstash-config/99314
**Category:** Logstash
**Created:** [September 4, 2017, 2:07pm UTC](https://discuss.elastic.co/t/-geoip-parse-failure-on-logstash-config/99314 "2017-09-04T14:07:21Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Shrawan\_Bhagwat](https://discuss.elastic.co/u/Shrawan_Bhagwat)
#### Post date: [September 4, 2017, 2:07pm UTC](https://discuss.elastic.co/t/-geoip-parse-failure-on-logstash-config/99314/1 "2017-09-04T14:07:21Z")
Hi all,
i have configured packet beat, filebeat and metricbeat.
i want to use it's geoIp feature and therefore i have used filter in logtsash config file.
but for each and evry configuration i am getting \_geoip\_parse\_failure.
Please guide.
```
input {
beats {
port => 5044
}
}
filter {
if [type] == "flow"
{
geoip {
source => "[event][source][ip]"
target => "geoip"
}
}
}
output {
stdout{}
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
```
Please guide.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [September 5, 2017, 3:29pm UTC](https://discuss.elastic.co/t/-geoip-parse-failure-on-logstash-config/99314/2 "2017-09-05T15:29:50Z")
Regarding logstash questions, maybe you are better off asking in the logstash forums.
Can you include the complete log message?
Have you checked the actual event contents? e.g. IPv6 addresses are reported in under `source.ipv6`. Also why are you using `[event]`? I think packetbeat only reports the field under `source.ip`, not `event.source.ip`.
Running packetbeat with `-d 'publish'` will have packetbeat print the events to be published to it's log file.
---
### Author:  [@Shrawan\_Bhagwat](https://discuss.elastic.co/u/Shrawan_Bhagwat)
#### Post date: [September 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/-geoip-parse-failure-on-logstash-config/99314/3 "2017-09-06T04:49:28Z")
Hi Steffens,
I tried to configure without `[event]` option but still i am getting same error in logstash logs.
> [2017-09-06T10:13:40,480][DEBUG][logstash.pipeline] output received {"event"=\>{"geoip"=\>{}, "source"=\>{"stats"=\>{"net\_bytes\_total"=\>109, "net\_packets
> \_total"=\>1}, "ip"=\>"0.0.0.0"}, "dest"=\>{"ip"=\>"1.1.1.1"}, "type"=\>"flow", "tags"=\>["beats\_input\_raw\_event", "\_geoip\_lookup\_failure"], "start\_time"=
>
> > "2017-09-06T04:44:11.723Z", "@timestamp"=\>2017-09-06T04:44:20.000Z, "last\_time"=\>"2017-09-06T04:44:11.723Z", "flow\_id"=\>"EAD/////AP////////8AAAEKKASCrBFyWw"
> > , "final"=\>false, "beat"=\>{"hostname"=\>"Brackman", "name"=\>"Brackman", "version"=\>"5.5.1"}, "@version"=\>"1", "host"=\>"Brackman"}}
and yes packetbeat reports IP as `source.ip` and therefore `[source][ip]` should work but it's giving `_geoip_parse_failure`.
Kindly help.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/-geoip-parse-failure-on-logstash-config/99314/4 "2017-09-06T05:32:06Z")
Well, 0.0.0.0 obviously can't be tied to a geolocation so it's not terribly surprising that the geoip filter fails.
---
### Author:  [@Shrawan\_Bhagwat](https://discuss.elastic.co/u/Shrawan_Bhagwat)
#### Post date: [September 6, 2017, 6:55am UTC](https://discuss.elastic.co/t/-geoip-parse-failure-on-logstash-config/99314/5 "2017-09-06T06:55:22Z")
Hi Magnus,
I have had changed IP addresses.
You can find below log files and screenshots that i am checking on Kibana and Graylog. Both logstash.conf are same.
Graylog image:
Kibana Image:
I am receiving `geoip_parse_failure` on kibana in `tags` while the same config is working fine in Graylog.
Logstash Config file:
```
input {
beats {
port => 5044
}
}
filter {
if [type] == "log"
{
if [message] =~ "AuthAccept|AuthLogout"
{
grok{
match => { "message" => "%{DATA:sm_eventID} %{DATA:sm_hostname} \[%{DATA}\] \"%{IPV4:UserIP} %{DATA:sm_username}\" \"%{DATA:sm_agent} %{DATA}\" (?(.|\r|\n)*)" }
}
}
else
{ drop{}
}
geoip {
source => "UserIP"
target => "geoip"
}
}
}
output {
stdout{}
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
```
Please guide.
Please note some fields are hidden.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 6, 2017, 7:09am UTC](https://discuss.elastic.co/t/-geoip-parse-failure-on-logstash-config/99314/6 "2017-09-06T07:09:47Z")
The IP address you are trying to look up is a [private address](https://en.wikipedia.org/wiki/IP_address), which is why the lookup fails.
---
### Author:  [@Shrawan\_Bhagwat](https://discuss.elastic.co/u/Shrawan_Bhagwat)
#### Post date: [September 6, 2017, 7:12am UTC](https://discuss.elastic.co/t/-geoip-parse-failure-on-logstash-config/99314/7 "2017-09-06T07:12:58Z")
Hi Christian,
one ques.
How it comes that on Graylog UI, it's showing correct location then?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 6, 2017, 7:19am UTC](https://discuss.elastic.co/t/-geoip-parse-failure-on-logstash-config/99314/8 "2017-09-06T07:19:39Z")
I don't know as I have no experience of Graylog. As it does not provide any latitude and longitude, which you typically get from the Maxmind lookup, maybe it makes assumptions about where host is located based on the locale where the software is installed?
---
### Author:  [@Shrawan\_Bhagwat](https://discuss.elastic.co/u/Shrawan_Bhagwat)
#### Post date: [September 6, 2017, 7:55am UTC](https://discuss.elastic.co/t/-geoip-parse-failure-on-logstash-config/99314/9 "2017-09-06T07:55:59Z")
Hi Christian,
Thanks for knowledge sharing 🙂
and if i use Maxmind lookup will it enhance my GeoIP results?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 6, 2017, 8:16am UTC](https://discuss.elastic.co/t/-geoip-parse-failure-on-logstash-config/99314/10 "2017-09-06T08:16:39Z")
Yes, but it can not map private Ids to a location as this varies by installation.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 4, 2017, 8:16am UTC](https://discuss.elastic.co/t/-geoip-parse-failure-on-logstash-config/99314/11 "2017-10-04T08:16:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.