Cant assign an nested ip from a json input to geoip

Elastic Stack Logstash
1

Run this command

$echo '{ "columns" : { "remote_address": "8.8.8.8"} }'  | /opt/logstash/bin/logstash --debug -e 'filter {  json{ source =>message }   geoip { source => "%{[columns][remote_address]}" } }

snipped debug output:

...
Default settings used: Filter workers: 4
closing {:plugin=><LogStash::Inputs::Stdin type=>"stdin", codec=><LogStash::Codecs::Line charset=>"UTF-8">>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
Using geoip database {:path=>"/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-2.0.2/vendor/GeoLiteCity-2013-01-18.dat", :level=>:info, :file=>"logstash/filters/geoip.rb", :line=>"97", :method=>"register"}
Worker threads expected: 4, worker threads started: 4 {:level=>:info, :file=>"logstash/pipeline.rb", :line=>"161", :method=>"start_filters"}
Logstash startup completed
closing {:plugin=><LogStash::Filters::Json source=>"message", periodic_flush=>false>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
closing {:plugin=><LogStash::Filters::Json source=>"message", periodic_flush=>false>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
closing {:plugin=><LogStash::Filters::Json source=>"message", periodic_flush=>false>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
closing {:plugin=><LogStash::Filters::GeoIP source=>"%{[columns][remote_address]}", periodic_flush=>false, target=>"geoip", lru_cache_size=>1000>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
closing {:plugin=><LogStash::Filters::GeoIP source=>"%{[columns][remote_address]}", periodic_flush=>false, target=>"geoip", lru_cache_size=>1000>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
closing {:plugin=><LogStash::Filters::GeoIP source=>"%{[columns][remote_address]}", periodic_flush=>false, target=>"geoip", lru_cache_size=>1000>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
Event after json filter {:event=>#<LogStash::Event:0x61838775 @metadata_accessors=#<LogStash::Util::Accessors:0x19bfc5c9 @store={}, @lut={}>, @cancelled=false, @data={"message"=>"{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }", "@version"=>"1", "@timestamp"=>"2016-04-25T09:10:53.991Z", "type"=>"stdin", "host"=>"logtest", "columns"=>{"remote_address"=>"8.8.8.8"}}, @metadata={}, @accessors=#<LogStash::Util::Accessors:0x561100a5 @store={"message"=>"{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }", "@version"=>"1", "@timestamp"=>"2016-04-25T09:10:53.991Z", "type"=>"stdin", "host"=>"logtest", "columns"=>{"remote_address"=>"8.8.8.8"}}, @lut={"type"=>[{"message"=>"{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }", "@version"=>"1", "@timestamp"=>"2016-04-25T09:10:53.991Z", "type"=>"stdin", "host"=>"logtest", "columns"=>{"remote_address"=>"8.8.8.8"}}, "type"], "host"=>[{"message"=>"{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }", "@version"=>"1", "@timestamp"=>"2016-04-25T09:10:53.991Z", "type"=>"stdin", "host"=>"logtest", "columns"=>{"remote_address"=>"8.8.8.8"}}, "host"], "message"=>[{"message"=>"{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }", "@version"=>"1", "@timestamp"=>"2016-04-25T09:10:53.991Z", "type"=>"stdin", "host"=>"logtest", "columns"=>{"remote_address"=>"8.8.8.8"}}, "message"]}>>, :level=>:debug, :file=>"logstash/filters/json.rb", :line=>"95", :method=>"filter"}
closing {:plugin=><LogStash::Filters::Json source=>"message", periodic_flush=>false>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
output received {:event=>{"message"=>"{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }", "@version"=>"1", "@timestamp"=>"2016-04-25T09:10:53.991Z", "type"=>"stdin", "host"=>"logtest", "columns"=>{"remote_address"=>"8.8.8.8"}}, :level=>:debug, :file=>"(eval)", :line=>"72", :method=>"output_func"}
closing {:plugin=><LogStash::Filters::GeoIP source=>"%{[columns][remote_address]}", periodic_flush=>false, target=>"geoip", lru_cache_size=>1000>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
{
       "message" => "{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }",
      "@version" => "1",
    "@timestamp" => "2016-04-25T09:10:53.991Z",
          "type" => "stdin",
          "host" => "logtest",
       "columns" => {
        "remote_address" => "8.8.8.8"
    }
}
closing {:plugin=><LogStash::Outputs::Stdout codec=><LogStash::Codecs::RubyDebug metadata=>false>, workers=>1>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
Pipeline shutdown complete. {:level=>:info, :file=>"logstash/pipeline.rb", :line=>"103", :method=>"run"}
Logstash shutdown completed
2

geoip { source => "%{[columns][remote_address]}" }

The source option should contain the name of a field, not its current contents. Try [columns][remote_address] instead.

3

Works like a charm ! thank you .

$ echo '{ "columns" : { "remote_address": "8.8.8.8"} }'  | /opt/logstash/bin/logstash --debug -e 'filter {  json{ source =>message }   geoip { source => "[columns][remote_address]" } } '

{
   "message" => "{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }",
  "@version" => "1",
"@timestamp" => "2016-04-26T20:54:02.840Z",
      "type" => "stdin",
      "host" => "logtest",
   "columns" => {
    "remote_address" => "8.8.8.8"
},
     "geoip" => {
                  "ip" => "8.8.8.8",
       "country_code2" => "US",
       "country_code3" => "USA",
        "country_name" => "United States",
      "continent_code" => "NA",
         "region_name" => "CA",
           "city_name" => "Mountain View",
         "postal_code" => "94043",
            "latitude" => 37.41919999999999,
           "longitude" => -122.0574,
            "dma_code" => 807,
           "area_code" => 650,
            "timezone" => "America/Los_Angeles",
    "real_region_name" => "California",
            "location" => [
        [0] -122.0574,
        [1] 37.41919999999999
    ]
 }
}