# Can you import geoip coordinates from outside? Mine are getting reversed

**URL:** <https://discuss.elastic.co/t/can-you-import-geoip-coordinates-from-outside-mine-are-getting-reversed/74312>\
**Category:** Logstash\
**Created:** [February 8, 2017, 3:17am UTC](https://discuss.elastic.co/t/can-you-import-geoip-coordinates-from-outside-mine-are-getting-reversed/74312 "2017-02-08T03:17:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dannypatel](https://avatars.discourse-cdn.com/v4/letter/d/aca169/32.png) [@dannypatel](https://discuss.elastic.co/u/dannypatel)\
**Post date:** [February 8, 2017, 3:17am UTC](https://discuss.elastic.co/t/can-you-import-geoip-coordinates-from-outside-mine-are-getting-reversed/74312/1 "2017-02-08T03:17:19Z")

</div>

Hello,  
I'm using ElasticSearch 5.0.1 and logstash 5.0.1. I'm ingesting web traffic logs which also already contain the longitude and latitude coordinates. I would like to use them to create a geoip geohash. Here is my setup details:

Sample Input:  
Feb 8 03:07:35 cache-iad2129 www-site-logs[438579]: 71.62.12.143 "-" "-" [08/Feb/2017:03:07:35 +0000] "GET /ios-config.php HTTP/1.1" 200 1002 "(null)" “DataRelease/317 CFNetwork/808.2.16 Darwin/16.3.0" "Charlottesville" "VA" US NA 37.954 -78.358 200 132681 +

Grok Pattern:  
%{GREEDYDATA:junk}]: %{IPORHOST:clientip} "%{USER:ident}" "%{USER:auth}" [%{HTTPDATE:timestamp}] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|"-") %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:agent} %{QS:geocity} %{QS:georegion} %{WORD:geocountrycode} %{WORD:geocontinentcode} %{NUMBER:geolat} %{NUMBER:geolong} %{NUMBER:origresponse} %{NUMBER:responsetime} %{GREEDYDATA:connstatus}

Logstash Filter Config:  
filter {  
if [syslogtag] == "www-access" {  
mutate {  
}

```
  grok {
    patterns_dir => ['/etc/logstash/patterns']
    add_field => { "logtype" => "fastly" }
    match => {
      "message" => “%{WWW_ACCESS}"
    }
  }
  if "_grokparsefailure" not in [tags] {
    geoip {
      source => "clientip"
      target => "geoip"
      add_field => ["[geoip][coordinates]", [geolat] ]
      add_field => ["[geoip][coordinates]", [geolong]]
      add_field => ["[geoip][longitude]", [geolong]]
      add_field => ["[geoip][latitude]", [geolat] ]
    }
    mutate {
      convert => ["[geoip][coordinates]", "float"]
      convert => ["[geoip][longitude]", "float"]
      convert => ["[geoip][latitude]", "float"]
    }
    mutate {
      convert => {
        "bytes" => "integer"
        "response" => "integer"
        "responsetime" => "integer"
        "origresponse" => "integer"
      }
      remove_field => ['timestamp']
      remove_field => ['junk']
      gsub => [
        "geocity", "\"", "",
        "georegion", "\"", ""
      ]
    }
    # The connection status when response is completed. Statuses include
    # X (connection aborted before the response completed),
    # + (connection may be kept alive after the response is sent),
    # - (connection will be closed after the response is sent).
    if [connstatus] =~ /\+/ {
      mutate { replace => { "connstatus" => "OPEN"} }
    }
    if [connstatus] =~ /X/ {
      mutate { replace => { "connstatus" => "ABORTED"} }
    }
    if [connstatus] =~ /-/ {
      mutate { replace => { "connstatus" => "CLOSE"} }
    }
  }

```

}  
}

Sample Document in logstash index:  
{  
"\_index": "platform-2017.02.07",  
"\_type": "platform",  
"\_id": "AVoWA7wSY5oq8LjuQ-DE",  
"\_score": 13.083577,  
"\_source": {  
"request": “/ios-config.php”,  
"agent": ""DataRelease/317 CFNetwork/808.2.16 Darwin/16.3.0"",  
"logstash\_host": “[redacted.hostname.com](http://redacted.hostname.com)",  
"auth": "-",  
"ident": "-",  
"geolong": "-78.358",  
"type": "platform",  
"connstatus": "OPEN",  
"logtype": “www-access”,  
"syslogtag": "www-access",  
"clientip": "71.62.12.143",  
"@version": "1",  
"host": “[redacted.host.com](http://redacted.host.com)",  
"responsetime": 132681,  
"geoip": {  
"timezone": "America/New\_York",  
"ip": "71.62.12.143",  
"latitude": 38.098,  
"coordinates": [  
0,  
0  
],  
"continent\_code": "NA",  
"city\_name": "Charlottesville",  
"country\_code2": "US",  
"country\_name": "United States",  
"dma\_code": 584,  
"country\_code3": "US",  
"region\_name": "Virginia",  
"location": [  
-78.3966,  
38.098  
],  
"postal\_code": "22911",  
"longitude": -78.3966,  
"region\_code": "VA"  
},  
"verb": "GET",  
"geocontinentcode": "NA",  
"geolat": "37.954",  
"geocountrycode": "US",  
"message": "Feb 8 03:07:35 cache-iad2129 www-site-logs[438579]: 71.62.12.143 "-" "-" [08/Feb/2017:03:07:35 +0000] "GET /ios-config.php HTTP/1.1" 200 1002 "(null)" “DataRelease/317 CFNetwork/808.2.16 Darwin/16.3.0" "Charlottesville" "VA" US NA 37.954 -78.358 200 132681 +  
\n",  
"tags": [],  
"referrer": ""(null)"",  
"@timestamp": "2017-02-07T03:07:35.829Z",  
"response": 200,  
"bytes": 1002,  
"kafka": {  
"consumer\_group": "logstash-platform",  
"partition": 1,  
"offset": 764654106,  
"topic": "platform",  
"key": null  
},  
"httpversion": "1.1",  
"geocity": "Charlottesville",  
"rsyslog\_timestamp": "2017-02-06T16:40:26.910541-08:00",  
"georegion": "VA",  
"origresponse": 200  
}  
},

My problem is that the geiop coordinates are getting added in reverse order, how do you fix that?

---

<div class="post-metadata">

**Author:** ![dannypatel](https://avatars.discourse-cdn.com/v4/letter/d/aca169/32.png) [@dannypatel](https://discuss.elastic.co/u/dannypatel)\
**Post date:** [February 8, 2017, 3:22am UTC](https://discuss.elastic.co/t/can-you-import-geoip-coordinates-from-outside-mine-are-getting-reversed/74312/2 "2017-02-08T03:22:22Z")

</div>

Here is my template mapping

"logstash": {  
"order": 0,  
"version": 50001,  
"template": "logstash-_",  
"settings": {  
"index": {  
"refresh\_interval": "5s"  
}  
},  
"mappings": {  
"default": {  
"dynamic\_templates": [  
{  
"message\_field": {  
"path\_match": "message",  
"mapping": {  
"norms": false,  
"type": "text"  
},  
"match\_mapping\_type": "string"  
}  
},  
{  
"string\_fields": {  
"mapping": {  
"norms": false,  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword"  
}  
}  
},  
"match\_mapping\_type": "string",  
"match": "_"  
}  
}  
],  
"\_all": {  
"norms": false,  
"enabled": true  
},  
"properties": {  
"@timestamp": {  
"include\_in\_all": false,  
"type": "date"  
},  
"geoip": {  
"dynamic": true,  
"properties": {  
"ip": {  
"type": "ip"  
},  
"latitude": {  
"type": "half\_float"  
},  
"location": {  
"type": "geo\_point"  
},  
"longitude": {  
"type": "half\_float"  
}  
}  
},  
"@version": {  
"include\_in\_all": false,  
"type": "keyword"  
}  
}  
}  
},  
"aliases": {}  
},

---

<div class="post-metadata">

**Author:** ![dannypatel](https://avatars.discourse-cdn.com/v4/letter/d/aca169/32.png) [@dannypatel](https://discuss.elastic.co/u/dannypatel)\
**Post date:** [February 8, 2017, 3:26am UTC](https://discuss.elastic.co/t/can-you-import-geoip-coordinates-from-outside-mine-are-getting-reversed/74312/3 "2017-02-08T03:26:10Z")

</div>

![](https://us1.discourse-cdn.com/elastic/original/2X/3/3b85ea1f71dca882e94d1012be09af491fef5c58.png)

---

<div class="post-metadata">

**Author:** ![dannypatel](https://avatars.discourse-cdn.com/v4/letter/d/aca169/32.png) [@dannypatel](https://discuss.elastic.co/u/dannypatel)\
**Post date:** [February 8, 2017, 3:27am UTC](https://discuss.elastic.co/t/can-you-import-geoip-coordinates-from-outside-mine-are-getting-reversed/74312/4 "2017-02-08T03:27:08Z")

</div>

Not getting anything on the map

![](https://us1.discourse-cdn.com/elastic/original/2X/0/03c83a4df8040fbd49286ca91c2f5cb791eb4681.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 8, 2017, 3:27am UTC](https://discuss.elastic.co/t/can-you-import-geoip-coordinates-from-outside-mine-are-getting-reversed/74312/5 "2017-03-08T03:27:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.