# Beats Netflow

**URL:** <https://discuss.elastic.co/t/beats-netflow/366746>\
**Category:** Elastic Agent\
**Created:** [September 18, 2024, 3:14pm UTC](https://discuss.elastic.co/t/beats-netflow/366746 "2024-09-18T15:14:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmgeurts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmgeurts/32/95115_2.png) [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)\
**Post date:** [September 18, 2024, 3:14pm UTC](https://discuss.elastic.co/t/beats-netflow/366746/1 "2024-09-18T15:14:27Z")

</div>

Hi all,

I've added Fleet Keycloak integration and deployed the policy to some Keycloak servers. I can see the logs in discovery, but the Keycloak integration doesn't include the GeoIP processor, so the reported `source.ip` field can't be processed during ingestion.

Is there a way to add GeoIP data through index management? Maybe by adding a mapping somewhere, but this is where I'm stuck. I've not found any instructions for managing template mappings in recent Elastic versions. Most GeoIP documentation details ingestion pipelines, but if a Fleet integration doesn't support it, then it'll need to be done later.

Thanks,

---

<div class="post-metadata">

**Author:** ![dmgeurts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmgeurts/32/95115_2.png) [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)\
**Post date:** [September 24, 2024, 3:42pm UTC](https://discuss.elastic.co/t/beats-netflow/366746/2 "2024-09-24T15:42:22Z")

</div>

Turns out GeoIP is supported for the Keycloak integration but I was testing with private IP addresses...