# Cant assign an nested ip from a json input to geoip

**URL:** <https://discuss.elastic.co/t/cant-assign-an-nested-ip-from-a-json-input-to-geoip/48292>\
**Category:** Logstash\
**Created:** [April 25, 2016, 9:33am UTC](https://discuss.elastic.co/t/cant-assign-an-nested-ip-from-a-json-input-to-geoip/48292 "2016-04-25T09:33:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![avisri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/avisri/32/5402_2.png) [@avisri](https://discuss.elastic.co/u/avisri)\
**Post date:** [April 25, 2016, 9:33am UTC](https://discuss.elastic.co/t/cant-assign-an-nested-ip-from-a-json-input-to-geoip/48292/1 "2016-04-25T09:33:34Z")

</div>

Run this command

```bash
$echo '{ "columns" : { "remote_address": "8.8.8.8"} }' | /opt/logstash/bin/logstash --debug -e 'filter { json{ source =>message } geoip { source => "%{[columns][remote_address]}" } } 

```

snipped debug output:

```auto
...
Default settings used: Filter workers: 4
closing {:plugin=><LogStash::Inputs::Stdin type=>"stdin", codec=><LogStash::Codecs::Line charset=>"UTF-8">>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
Using geoip database {:path=>"/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-2.0.2/vendor/GeoLiteCity-2013-01-18.dat", :level=>:info, :file=>"logstash/filters/geoip.rb", :line=>"97", :method=>"register"}
Worker threads expected: 4, worker threads started: 4 {:level=>:info, :file=>"logstash/pipeline.rb", :line=>"161", :method=>"start_filters"}
Logstash startup completed
closing {:plugin=><LogStash::Filters::Json source=>"message", periodic_flush=>false>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
closing {:plugin=><LogStash::Filters::Json source=>"message", periodic_flush=>false>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
closing {:plugin=><LogStash::Filters::Json source=>"message", periodic_flush=>false>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
closing {:plugin=><LogStash::Filters::GeoIP source=>"%{[columns][remote_address]}", periodic_flush=>false, target=>"geoip", lru_cache_size=>1000>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
closing {:plugin=><LogStash::Filters::GeoIP source=>"%{[columns][remote_address]}", periodic_flush=>false, target=>"geoip", lru_cache_size=>1000>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
closing {:plugin=><LogStash::Filters::GeoIP source=>"%{[columns][remote_address]}", periodic_flush=>false, target=>"geoip", lru_cache_size=>1000>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
Event after json filter {:event=>#<LogStash::Event:0x61838775 @metadata_accessors=#<LogStash::Util::Accessors:0x19bfc5c9 @store={}, @lut={}>, @cancelled=false, @data={"message"=>"{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }", "@version"=>"1", "@timestamp"=>"2016-04-25T09:10:53.991Z", "type"=>"stdin", "host"=>"logtest", "columns"=>{"remote_address"=>"8.8.8.8"}}, @metadata={}, @accessors=#<LogStash::Util::Accessors:0x561100a5 @store={"message"=>"{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }", "@version"=>"1", "@timestamp"=>"2016-04-25T09:10:53.991Z", "type"=>"stdin", "host"=>"logtest", "columns"=>{"remote_address"=>"8.8.8.8"}}, @lut={"type"=>[{"message"=>"{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }", "@version"=>"1", "@timestamp"=>"2016-04-25T09:10:53.991Z", "type"=>"stdin", "host"=>"logtest", "columns"=>{"remote_address"=>"8.8.8.8"}}, "type"], "host"=>[{"message"=>"{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }", "@version"=>"1", "@timestamp"=>"2016-04-25T09:10:53.991Z", "type"=>"stdin", "host"=>"logtest", "columns"=>{"remote_address"=>"8.8.8.8"}}, "host"], "message"=>[{"message"=>"{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }", "@version"=>"1", "@timestamp"=>"2016-04-25T09:10:53.991Z", "type"=>"stdin", "host"=>"logtest", "columns"=>{"remote_address"=>"8.8.8.8"}}, "message"]}>>, :level=>:debug, :file=>"logstash/filters/json.rb", :line=>"95", :method=>"filter"}
closing {:plugin=><LogStash::Filters::Json source=>"message", periodic_flush=>false>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
output received {:event=>{"message"=>"{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }", "@version"=>"1", "@timestamp"=>"2016-04-25T09:10:53.991Z", "type"=>"stdin", "host"=>"logtest", "columns"=>{"remote_address"=>"8.8.8.8"}}, :level=>:debug, :file=>"(eval)", :line=>"72", :method=>"output_func"}
closing {:plugin=><LogStash::Filters::GeoIP source=>"%{[columns][remote_address]}", periodic_flush=>false, target=>"geoip", lru_cache_size=>1000>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
{
       "message" => "{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }",
      "@version" => "1",
    "@timestamp" => "2016-04-25T09:10:53.991Z",
          "type" => "stdin",
          "host" => "logtest",
       "columns" => {
        "remote_address" => "8.8.8.8"
    }
}
closing {:plugin=><LogStash::Outputs::Stdout codec=><LogStash::Codecs::RubyDebug metadata=>false>, workers=>1>, :level=>:debug, :file=>"logstash/plugin.rb", :line=>"35", :method=>"do_close"}
Pipeline shutdown complete. {:level=>:info, :file=>"logstash/pipeline.rb", :line=>"103", :method=>"run"}
Logstash shutdown completed

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 25, 2016, 8:06pm UTC](https://discuss.elastic.co/t/cant-assign-an-nested-ip-from-a-json-input-to-geoip/48292/2 "2016-04-25T20:06:50Z")

</div>

> geoip { source =\> "%{[columns][remote\_address]}" }

The `source` option should contain the _name_ of a field, not its current contents. Try `[columns][remote_address]` instead.

---

<div class="post-metadata">

**Author:** ![avisri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/avisri/32/5402_2.png) [@avisri](https://discuss.elastic.co/u/avisri)\
**Post date:** [April 26, 2016, 8:56pm UTC](https://discuss.elastic.co/t/cant-assign-an-nested-ip-from-a-json-input-to-geoip/48292/3 "2016-04-26T20:56:25Z")

</div>

> [@avisri](#):
>
> echo '{ "columns" : { "remote\_address": "8.8.8.8"} }' | /opt/logstash/bin/logstash --debug -e 'filter { json{ source =\>message } geoip { source =\> "%{[columns][remote\_address]}" } }

Works like a charm ! thank you .

```
$ echo '{ "columns" : { "remote_address": "8.8.8.8"} }' | /opt/logstash/bin/logstash --debug -e 'filter { json{ source =>message } geoip { source => "[columns][remote_address]" } } '

{
   "message" => "{ \"columns\" : { \"remote_address\": \"8.8.8.8\"} }",
  "@version" => "1",
"@timestamp" => "2016-04-26T20:54:02.840Z",
      "type" => "stdin",
      "host" => "logtest",
   "columns" => {
    "remote_address" => "8.8.8.8"
},
     "geoip" => {
                  "ip" => "8.8.8.8",
       "country_code2" => "US",
       "country_code3" => "USA",
        "country_name" => "United States",
      "continent_code" => "NA",
         "region_name" => "CA",
           "city_name" => "Mountain View",
         "postal_code" => "94043",
            "latitude" => 37.41919999999999,
           "longitude" => -122.0574,
            "dma_code" => 807,
           "area_code" => 650,
            "timezone" => "America/Los_Angeles",
    "real_region_name" => "California",
            "location" => [
        [0] -122.0574,
        [1] 37.41919999999999
    ]
 }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:00am UTC](https://discuss.elastic.co/t/cant-assign-an-nested-ip-from-a-json-input-to-geoip/48292/4 "2017-07-06T05:00:26Z")

</div>