# Create Custom geoip database for Logstash 5.2

**URL:** <https://discuss.elastic.co/t/create-custom-geoip-database-for-logstash-5-2/79473>\
**Category:** Logstash\
**Created:** [March 21, 2017, 4:50pm UTC](https://discuss.elastic.co/t/create-custom-geoip-database-for-logstash-5-2/79473 "2017-03-21T16:50:43Z")\
**Posts on this page:** 1\
**Showing post:** 13

<div class="post-metadata">

**Author:** ![Grenouille06](https://avatars.discourse-cdn.com/v4/letter/g/48db29/32.png) [@Grenouille06](https://discuss.elastic.co/u/Grenouille06)\
**Post date:** [March 28, 2017, 7:03am UTC](https://discuss.elastic.co/t/create-custom-geoip-database-for-logstash-5-2/79473/13 "2017-03-28T07:03:11Z")

</div>

Hi Christian. I tried something simple. I ues 2 yaml files : latitude.yml and longitude.yml

latitude.yml  
10.22.33._: "43.701535"  
10.13.33._: "43.718560"  
10.23.33._: "43.718560"  
10.12.96._: "43.678237"

longitude.yaml  
10.22.33._: "7.281819"  
10.13.33._: "7.265417"  
10.23.33._: "7.265417"  
10.12.96._: "7.228675"

and my filter conf :

```
filter {
 if "[event_data][IpAddress]" =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/ {
  translate {
    dictionary_path => "/etc/logstash/mutate/nca-latitude.yml"
    field => "[event_data][IpAddress]" 
    destination => "[geoip][latitude]"
    override => true
    }
  translate {
    dictionary_path => "/etc/logstash/mutate/nca-longitude.yml"
    field => "[event_data][IpAddress]" 
    destination => "[geoip.longitude]"
    }
  mutate {
    convert => { "[geoip][longitude]" => "float" }
    convert => { "[geoip][latitude]" => "float" }
  }
 }
}

```

I want to match the IP in my field "[event\_data][IpAddress]" with one of my yaml file and add  
"[geoip][longitude]" and "[geoip][latitude]"

I don't knom if the star at the end of each ip is the right thing to do (\* should be 0 to 255).

Thanks for help and advices

---

_[View the full topic](https://discuss.elastic.co/t/create-custom-geoip-database-for-logstash-5-2/79473)._