# Apache logs not able to map geo IPs

**URL:** <https://discuss.elastic.co/t/apache-logs-not-able-to-map-geo-ips/98429>\
**Category:** Logstash\
**Created:** [August 26, 2017, 3:56am UTC](https://discuss.elastic.co/t/apache-logs-not-able-to-map-geo-ips/98429 "2017-08-26T03:56:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [August 26, 2017, 3:56am UTC](https://discuss.elastic.co/t/apache-logs-not-able-to-map-geo-ips/98429/1 "2017-08-26T03:56:39Z")

</div>

Hi Guys,

I am trying to plot the geo for my apache logs but somehow I am getting below error on kibana, can someone please help me on this error?

No Compatible Fields: The "apache-\*" index pattern does not contain any of the following field types: geo\_point

This is my logstash file

input {  
# add necessary input parameters  
file {  
path =\> "/var/apache/access\_log"  
start\_position =\> "beginning"

```
    }

```

}

filter {

```
    # for Apache Access logs
    grok {
            match => { "message" => "%{COMBINEDAPACHELOG}" }
    }

    # for Apache Access logs
    grok {
            match => { "message" => "%{EXTENDEDAPACHELOG}" }
            patterns_dir => ["/etc/logstash/patterns"]
    }

    # for Apache Error logs
    grok {
    match => { "message" => "%{APACHEERRORLOG}" }
    patterns_dir => ["/etc/logstash/patterns"]
}

    date {
            match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
            remove_field => "timestamp"
    }
    useragent {
            source => "agent"
            target => "UA"
    }
    mutate {
            convert => ["response","integer"]
            convert => ["bytes","integer"]
            convert => ["responsetime","integer"]
    }
    geoip {
            source => "clientip"
            target => geoip
            add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
            add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
    }
    mutate {
            convert => ["[geoip][coordinates]", "float" ]
    }

```

}

output {  
# add necessary output parameters  
elasticsearch {  
hosts =\> "192.168.5.15:9200"  
index =\> "apache-logs-%{+YYYY.MM.dd}"  
}  
stdout  
{  
codec =\> rubydebug  
}  
}

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [August 26, 2017, 4:05am UTC](https://discuss.elastic.co/t/apache-logs-not-able-to-map-geo-ips/98429/2 "2017-08-26T04:05:43Z")

</div>

Here is the thread I followed to troubleshoot and able to query the logs correctly based on lon/lat but not sure why that error is appearing

> **[GEOIP Enable](https://discuss.elastic.co/t/geoip-enable/74116)**
>
> Hi Firstly i am apologise for bugging the forum but it is just that i really want this to work. I have setup the stack using this link...

echo 37.58.58.206 | /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/test.config  
09:30:55.665 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=\>9601}  
{  
"@timestamp" =\> 2017-08-26T04:00:55.645Z,  
"geoip" =\> {  
"ip" =\> "37.58.58.206",  
"latitude" =\> 51.2993,  
"country\_name" =\> "Germany",  
"country\_code2" =\> "DE",  
"continent\_code" =\> "EU",  
"country\_code3" =\> "DE",  
"location" =\> {  
"lon" =\> 9.491,  
"lat" =\> 51.2993  
},  
"longitude" =\> 9.491  
},  
"@version" =\> "1",  
"host" =\> "0.0.0.0",  
"message" =\> "37.58.58.206"

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 26, 2017, 4:55am UTC](https://discuss.elastic.co/t/apache-logs-not-able-to-map-geo-ips/98429/3 "2017-08-26T04:55:40Z")

</div>

[GeoIP in the Elastic Stack - Elasticsearch, Logstash, Ingest API | Elastic Blog](https://www.elastic.co/blog/geoip-in-the-elastic-stack) is worth reading too.

> [@Blason](#):
>
> geoip {  
> source =\> "clientip"  
> target =\> geoip  
> add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
> add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
> }  
> mutate {  
> convert =\> ["[geoip][coordinates]", "float" ]  
> }

But you're over thinking things, check that blog post for more.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 23, 2017, 4:56am UTC](https://discuss.elastic.co/t/apache-logs-not-able-to-map-geo-ips/98429/4 "2017-09-23T04:56:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.