Hi Ritesh,
I achieved this by downloading GeoLiteCity.dat from "http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz" . It is a database which will assign (Lat,Log) to your IPs.Once downloaded and unzipped you need to create a logstash conf file , something like
filter {
geoip {
source => "clientip"
target => "geoip"
database => "E:/Geo_database/GeoLiteCity.dat"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => [ "[geoip][coordinates]", "float"]
}
}
In your case clientip would be Address1 or address2 . Now , in kibana in the Aggregation drop-down, select Geohash and In the Field drop-down, select geoip.location.
Take some help from "https://www.digitalocean.com/community/tutorials/how-to-map-user-location-with-geoip-and-elk-elasticsearch-logstash-and-kibana". A very nice tutorial by Mitchell Anicas.
Hope this will help you to start .