# Can Anyone tell each and every step of how to use geoIP with logstash and kibana?

**URL:** https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420
**Category:** Logstash
**Created:** [September 22, 2017, 6:02am UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420 "2017-09-22T06:02:39Z")
**Posts on this page:** 13
**Page:** 1

<div class="post-metadata">

### Author: ![PinkiMondal](https://avatars.discourse-cdn.com/v4/letter/p/a698b9/32.png) [@PinkiMondal](https://discuss.elastic.co/u/PinkiMondal)
#### Post date: [September 22, 2017, 6:02am UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420/1 "2017-09-22T06:02:39Z")

</div>

Hi All  
I have GeoLite2-City.mmdb and logstash ver 5.4.0. I am trying to use the db but nothing is working out.  
Can anyone please explain the steps needed to do the loading of IP address in Logstash and transformed it into longitude and latitude in ES index  
How to do this ??? Please explain that would be great help

Thanks

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 22, 2017, 6:05am UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420/2 "2017-09-22T06:05:06Z")

</div>

[https://www.elastic.co/blog/geoip-in-the-elastic-stack](https://www.elastic.co/blog/geoip-in-the-elastic-stack) should help you out.

If you follow that and still have issues, please provide as much detail as you can 🙂

---

<div class="post-metadata">

### Author: ![PinkiMondal](https://avatars.discourse-cdn.com/v4/letter/p/a698b9/32.png) [@PinkiMondal](https://discuss.elastic.co/u/PinkiMondal)
#### Post date: [September 22, 2017, 6:06am UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420/3 "2017-09-22T06:06:55Z")

</div>

Thank you for such a quick reply 🤩. Let me work it out. Will let you know if case of any query 😇

---

<div class="post-metadata">

### Author: ![PinkiMondal](https://avatars.discourse-cdn.com/v4/letter/p/a698b9/32.png) [@PinkiMondal](https://discuss.elastic.co/u/PinkiMondal)
#### Post date: [September 22, 2017, 6:08am UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420/4 "2017-09-22T06:08:29Z")

</div>

This link is not working 😥 @warkolm

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 22, 2017, 6:08am UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420/5 "2017-09-22T06:08:46Z")

</div>

Works fine for me?

---

<div class="post-metadata">

### Author: ![PinkiMondal](https://avatars.discourse-cdn.com/v4/letter/p/a698b9/32.png) [@PinkiMondal](https://discuss.elastic.co/u/PinkiMondal)
#### Post date: [September 22, 2017, 1:58pm UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420/6 "2017-09-22T13:58:47Z")

</div>

Thank You so much 🙂

---

<div class="post-metadata">

### Author: ![PinkiMondal](https://avatars.discourse-cdn.com/v4/letter/p/a698b9/32.png) [@PinkiMondal](https://discuss.elastic.co/u/PinkiMondal)
#### Post date: [September 22, 2017, 2:24pm UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420/7 "2017-09-22T14:24:42Z")

</div>

Can you tell where to give Template via Logstash file?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 23, 2017, 7:54am UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420/8 "2017-09-23T07:54:31Z")

</div>

[https://www.elastic.co/guide/en/logstash/5.6/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template](https://www.elastic.co/guide/en/logstash/5.6/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template)

---

<div class="post-metadata">

### Author: ![PinkiMondal](https://avatars.discourse-cdn.com/v4/letter/p/a698b9/32.png) [@PinkiMondal](https://discuss.elastic.co/u/PinkiMondal)
#### Post date: [September 26, 2017, 3:54am UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420/9 "2017-09-26T03:54:40Z")

</div>

I want to apply mapping on a particular index. How to apply that??? because by default when data is inserted through Logstash, **geoip.location** is set a float but its type should be **geo\_point**.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 26, 2017, 4:41am UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420/10 "2017-09-26T04:41:01Z")

</div>

If you are using the default Logstash configuration then it will be mapped to a geopoint.  
If it's not doing that, then providing your config would be a useful starting point to troubleshooting.

---

<div class="post-metadata">

### Author: ![PinkiMondal](https://avatars.discourse-cdn.com/v4/letter/p/a698b9/32.png) [@PinkiMondal](https://discuss.elastic.co/u/PinkiMondal)
#### Post date: [September 26, 2017, 5:05am UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420/11 "2017-09-26T05:05:11Z")

</div>

This is my configuration file...  
By this I am getting float type of geoip.location. How can I give mapping in this file ?  
input {  
stdin {}  
}

filter {  
grok {  
match =\> { "message" =\> "%{COMBINEDAPACHELOG}" }  
}  
geoip {  
source =\> "clientip"  
}  
}

output {  
stdout { codec =\> dots }  
elasticsearch {  
hosts =\> ["ipAddress:port"]  
index =\> "my\_index"  
document\_type =\> "my\_type"  
}  
}

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 26, 2017, 10:49pm UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420/12 "2017-09-26T22:49:07Z")

</div>

> [@PinkiMondal](#):
>
> index =\> "my\_index"

That's why, the default template won't match that index pattern.

Have a look at the _Custom Index Names_ section of this [GeoIP in the Elastic Stack - Elasticsearch, Logstash, Ingest API | Elastic Blog](https://www.elastic.co/blog/geoip-in-the-elastic-stack)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 24, 2017, 10:49pm UTC](https://discuss.elastic.co/t/can-anyone-tell-each-and-every-step-of-how-to-use-geoip-with-logstash-and-kibana/101420/13 "2017-10-24T22:49:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
