# Add map to ELK with pfsense

**URL:** <https://discuss.elastic.co/t/add-map-to-elk-with-pfsense/31250>\
**Category:** Logstash\
**Created:** [September 28, 2015, 10:41am UTC](https://discuss.elastic.co/t/add-map-to-elk-with-pfsense/31250 "2015-09-28T10:41:27Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![megarobo](https://avatars.discourse-cdn.com/v4/letter/m/e0b2c6/32.png) [@megarobo](https://discuss.elastic.co/u/megarobo)\
**Post date:** [September 28, 2015, 10:41am UTC](https://discuss.elastic.co/t/add-map-to-elk-with-pfsense/31250/1 "2015-09-28T10:41:27Z")

</div>

i use ELK logstash 1.4 and kibana 3 and pfsense  
my ELK work very good and show map that IP blocked by countries  
i want to add map like this but with map countries with passed IP  
i possible and witch configuration need to edit  
i use this toutrial fully install  
[http://www.mediafire.com/view/j25mbohmmxvt7g4/Installing\_ELK\_on\_Lubuntu\_15.0.4\_ON\_HYPER-V.docx](http://www.mediafire.com/view/j25mbohmmxvt7g4/Installing_ELK_on_Lubuntu_15.0.4_ON_HYPER-V.docx)

anyone can help

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 28, 2015, 10:51am UTC](https://discuss.elastic.co/t/add-map-to-elk-with-pfsense/31250/2 "2015-09-28T10:51:57Z")

</div>

> [@megarobo](#):
>
> i want to add map like this but with map countries with passed IP

Can you explain this a little more?

---

<div class="post-metadata">

**Author:** ![megarobo](https://avatars.discourse-cdn.com/v4/letter/m/e0b2c6/32.png) [@megarobo](https://discuss.elastic.co/u/megarobo)\
**Post date:** [September 28, 2015, 11:36am UTC](https://discuss.elastic.co/t/add-map-to-elk-with-pfsense/31250/3 "2015-09-28T11:36:52Z")

</div>

@warkolm thanks for replaying  
see like this picture

 ![](https://us1.discourse-cdn.com/elastic/original/2X/5/5b457f81cd36e124e7dad4219fc682462c54ecc5.png)

i have map for ip block countries i need to add map that show ip passed by countries  
i add map with configuration like my other map but its not work  
this is my 11-pfsense.conf

> filter {  
> if "PFSense" in [tags] {  
> grok {  
> add\_tag =\> ["firewall"]  
> match =\> ["message", "\<(?._)\>(?(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\s+(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?:2[0123]|[01]?[0-9]):(?:[0-5][0-9]):(?:[0-5][0-9])) (?._?): (?.\*)" ]  
> }  
> mutate {  
> gsub =\> ["datetime"," "," "]  
> }  
> date {  
> match =\> ["datetime", "MMM dd HH:mm:ss"]  
> }  
> mutate {  
> replace =\> ["message", "%{msg}"]  
> }  
> mutate {  
> remove\_field =\> ["msg", "datetime"]  
> }  
> }  
> if [prog] =~ /^filterlog$/ {  
> mutate {  
> remove\_field =\> ["msg", "datetime"]  
> }  
> grok {  
> patterns\_dir =\> "/opt/logstash/patterns"  
> match =\> ["message", "%{LOG\_DATA}%{IP\_SPECIFIC\_DATA}%{IP\_DATA}%{PROTOCOL\_DATA}"]  
> }  
> mutate {  
> lowercase =\> ['proto']  
> }  
> geoip {  
> add\_tag =\> ["GeoIP"]  
> source =\> "src\_ip"  
> target =\> "geoip"  
> database =\> "/opt/logstash/vendor/geoip/GeoLiteCity.dat"  
> add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
> add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
> }  
> }  
> }

my elk work but geo ip showjust blocked ip i want to see block or pass ip in map

---

<div class="post-metadata">

**Author:** ![megarobo](https://avatars.discourse-cdn.com/v4/letter/m/e0b2c6/32.png) [@megarobo](https://discuss.elastic.co/u/megarobo)\
**Post date:** [September 29, 2015, 2:20pm UTC](https://discuss.elastic.co/t/add-map-to-elk-with-pfsense/31250/4 "2015-09-29T14:20:26Z")

</div>

nobody can help ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 29, 2015, 2:27pm UTC](https://discuss.elastic.co/t/add-map-to-elk-with-pfsense/31250/5 "2015-09-29T14:27:50Z")

</div>

Do some of the passed events exist in Elasticsearch?

---

<div class="post-metadata">

**Author:** ![megarobo](https://avatars.discourse-cdn.com/v4/letter/m/e0b2c6/32.png) [@megarobo](https://discuss.elastic.co/u/megarobo)\
**Post date:** [September 29, 2015, 2:34pm UTC](https://discuss.elastic.co/t/add-map-to-elk-with-pfsense/31250/6 "2015-09-29T14:34:01Z")

</div>

i dont understand what is mean ?!  
i see pass event in my firewall and see it in ELK

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 30, 2015, 9:01am UTC](https://discuss.elastic.co/t/add-map-to-elk-with-pfsense/31250/7 "2015-09-30T09:01:02Z")

</div>

It looks like your dashboard has been built around blocked events, what are the queries/filters you have applied?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:27am UTC](https://discuss.elastic.co/t/add-map-to-elk-with-pfsense/31250/8 "2017-07-06T05:27:41Z")

</div>