# Can geoip source be a sub-field?
**URL:** https://discuss.elastic.co/t/can-geoip-source-be-a-sub-field/66951
**Category:** Logstash
**Created:** [November 23, 2016, 7:31am UTC](https://discuss.elastic.co/t/can-geoip-source-be-a-sub-field/66951 "2016-11-23T07:31:37Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Balsam](https://discuss.elastic.co/u/Balsam)
#### Post date: [November 23, 2016, 7:31am UTC](https://discuss.elastic.co/t/can-geoip-source-be-a-sub-field/66951/1 "2016-11-23T07:31:37Z")
Hello everyone,
I'm new to ELK. I'm learning to use it to store and analyze Suricata events. Everything is working except I can't get geoip working. The problem is the geoip source is from a sub-field and when I put the sub-field in my filter, it doesn't work. Here is an example of Suricata events.
{"timestamp":".....","in\_iface":"br0","event\_type":"http","src\_ip":"10.200.238.66","src\_port":88
45,"dest\_ip":"10.200.237.111","dest\_port":80,"proto":"TCP","tx\_id":0, **"http"** :{"hostname":"[example.com](http://example.com)","url":"......","http\_user\_agent":"Mozilla", **"xff":"1.2.3.4"** ,"http\_refer":"https://........","http\_method":"GET","protocol":"HTTP/1.1","status":304,"length":0}}
Here is my filter.
if [http] {
mutate {
add\_field =\> { "real\_ip" =\> "%{[http][xff]}" }
}
**geoip { source =\> "[http][xff]" }**
}
As you can see, [http][xff] is the real client IP that Suricata writes to the event log based on the "X-Forwarded-For" header of the http request. I want geoip to look up for this IP address.
However, **it seems like geoip cannot recognize this sub-filed.** I always got "tags"=\>["\_geoip\_lookup\_failure"] and "geoip"=\>{}. But the add\_field =\> { "real\_ip" =\> "%{[http][xff]}" } also use the sub-field and it works just fine.
I turned on logstash debug logging and I can see the config in the log as below.
[2016-11-23T00:08:42,954][DEBUG][logstash.filters.geoip] config LogStash::Filters::GeoIP/@source = "[http][xff]"
[2016-11-23T00:08:43,368][DEBUG][logstash.filters.geoip] config LogStash::Filters::GeoIP/@source = "src\_ip"
[2016-11-23T00:08:43,373][DEBUG][logstash.filters.geoip] config LogStash::Filters::GeoIP/@source = "dest\_ip"
**I don't quite understand why "src\_ip" and "dest\_ip" also appear in the log even though they are not specified as geoip sources in my config file.**
The following in the log are obvious. GeoIP tried to look up the src\_ip and dest\_ip that are both internal IP addresses thus got "IP not found".
[2016-11-23T00:09:19,671][DEBUG][logstash.filters.geoip] IP not found! {:exception=\>com.maxmind.geoip2.exception.AddressNotFoundException: The address 10.200.238.66 is not in the database., :field=\>"src\_ip", :event=\>2016-11-23T00:09:18.735Z}
[2016-11-23T00:09:19,672][DEBUG][logstash.filters.geoip] IP 10.200.238.66 was not found in the database {:event=\>2016-11-23T00:09:18.735Z }
[2016-11-23T00:09:19,672][DEBUG][logstash.filters.geoip] IP not found! {:exception=\>com.maxmind.geoip2.exception.AddressNotFoundException: The address 10.200.237.111 is not in the database., :field=\>"dest\_ip", :event=\>2016-11-23T00:09:18.735Z }
[2016-11-23T00:09:19,673][DEBUG][logstash.filters.geoip] IP 10.200.237.111 was not found in the database {:event=\>2016-11-23T00:09:18.735Z }
**Is there anything wrong with my geoip filter config? Is a sub-field supported as a geoip source?**
Thanks. Any help is greatly appreciated!
---
### Author:  [@Balsam](https://discuss.elastic.co/u/Balsam)
#### Post date: [November 23, 2016, 11:10pm UTC](https://discuss.elastic.co/t/can-geoip-source-be-a-sub-field/66951/2 "2016-11-23T23:10:11Z")
I figured out why it didn't work. I copied the old pipeline config file under conf.d to something.conf.sav and edit something.conf with my new filters. I though logstash would ONLY load conf.d/\*.conf, but looks like it loads all the files in conf.d.
---
### Author:  [@miguelplazasr](https://discuss.elastic.co/u/miguelplazasr)
#### Post date: [November 24, 2016, 5:40pm UTC](https://discuss.elastic.co/t/can-geoip-source-be-a-sub-field/66951/3 "2016-11-24T17:40:58Z")
Hi, you could solve this?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 22, 2016, 5:41pm UTC](https://discuss.elastic.co/t/can-geoip-source-be-a-sub-field/66951/4 "2016-12-22T17:41:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.