# Coaxing geoip data from logstash
**URL:** https://discuss.elastic.co/t/coaxing-geoip-data-from-logstash/159176
**Category:** Logstash
**Created:** [December 3, 2018, 12:41pm UTC](https://discuss.elastic.co/t/coaxing-geoip-data-from-logstash/159176 "2018-12-03T12:41:42Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)
#### Post date: [December 3, 2018, 12:41pm UTC](https://discuss.elastic.co/t/coaxing-geoip-data-from-logstash/159176/1 "2018-12-03T12:41:42Z")
I have logstash setup to convert ip -\> geoip. Im getting latitude/longitude coordinates from apache2/filebeat now. What I don't seem to have is whatever is required to create a visualization from this data.
I've read through various posts on this ([here](https://discuss.elastic.co/t/how-to-construct-geo-point-field-from-separate-fields-of-latitude-and-longitude-for-kibana-5-4/91755/4) and [here](https://discuss.elastic.co/t/change-geo-location-to-geo-point-data-type/73015/18)) but haven't yet found the secret sauce to make kibana happy yet.
Relevant entry from logstash:
```
geoip {
source => "clientip"
}
mutate {
convert => { "[geoip][longitude]" => "float" }
convert => { "[geoip][latitude]" => "float" }
}
mutate {
rename => {
"[geoip][longitude]" => "[location][lon]"
"[geoip][latitude]" => "[location][lat]"
}
}
```
So now Im getting [geoip][location][lon]/[lat] in my data with type "float". How do I get this saved (consistentl) as "geoip"?
---
### Author:  [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)
#### Post date: [December 7, 2018, 12:33pm UTC](https://discuss.elastic.co/t/coaxing-geoip-data-from-logstash/159176/2 "2018-12-07T12:33:42Z")
Some additional info: Im trying to parse apache2 logs to see who is abusing / probing it. Ive got the files parsed out using logstash and can see the geoip.[country|region|etc] fields in the 'discover' window in kibana.
The logs are parsed into a new index "apache2-\*". This is probably where my issues begin. I don't have a template defined for this and am not sure how to create one.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 4, 2019, 12:33pm UTC](https://discuss.elastic.co/t/coaxing-geoip-data-from-logstash/159176/3 "2019-01-04T12:33:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.