# Enriching Logs with Internal Geo Ip Location Lookups

**URL:** <https://discuss.elastic.co/t/enriching-logs-with-internal-geo-ip-location-lookups/95746>\
**Category:** Logstash\
**Created:** [August 3, 2017, 3:51pm UTC](https://discuss.elastic.co/t/enriching-logs-with-internal-geo-ip-location-lookups/95746 "2017-08-03T15:51:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![megadevx](https://avatars.discourse-cdn.com/v4/letter/m/c67d28/32.png) [@megadevx](https://discuss.elastic.co/u/megadevx)\
**Post date:** [August 3, 2017, 3:51pm UTC](https://discuss.elastic.co/t/enriching-logs-with-internal-geo-ip-location-lookups/95746/1 "2017-08-03T15:51:10Z")

</div>

I have been trying to find a way to do internal Geo IP lookup to enrich logs. I have over 500 subnets with specific locations for each that I want to map the whole subnet to that location. Is there any way that this would be possible with the current plugins. If not I would really appreciate it if we could maybe open an issue to get this sort of function added to logstash.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 3, 2017, 5:54pm UTC](https://discuss.elastic.co/t/enriching-logs-with-internal-geo-ip-location-lookups/95746/2 "2017-08-03T17:54:50Z")

</div>

Have a look at the cidr and translate filters. The former allows you to set fields based on whether an IP address matches a CIDR subnet specification (so you'll end up with one filter per subnet, but you'd obviously generate that configuration) while the translate filter would require you to enumerate all IP addresses in each subnet but would allow you to specify the mappings between IP addresses and resulting location values in a single file referenced by a single translate filter.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 3, 2017, 8:18pm UTC](https://discuss.elastic.co/t/enriching-logs-with-internal-geo-ip-location-lookups/95746/3 "2017-08-03T20:18:46Z")

</div>

Alternatively, use the geoip filter, but [build your own](https://blog.maxmind.com/2015/09/29/building-your-own-mmdb-database-for-fun-and-profit/) MMDB that includes your internal networks. I have not tried it, but it seems like a reasonable approach.

---

<div class="post-metadata">

**Author:** ![megadevx](https://avatars.discourse-cdn.com/v4/letter/m/c67d28/32.png) [@megadevx](https://discuss.elastic.co/u/megadevx)\
**Post date:** [August 3, 2017, 9:49pm UTC](https://discuss.elastic.co/t/enriching-logs-with-internal-geo-ip-location-lookups/95746/4 "2017-08-03T21:49:30Z")

</div>

I have figured out a way to do it using this using a previous thread and by using python to manipulate a couple of csv's to create the yaml file this thread talks about. [Create Custom geoip database for Logstash 5.2](https://discuss.elastic.co/t/create-custom-geoip-database-for-logstash-5-2/79473/14)

Thank you guys for all the suggestions. If anyone has questions about the script or the yaml file, or the filter just shoot me a message. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2017, 9:50pm UTC](https://discuss.elastic.co/t/enriching-logs-with-internal-geo-ip-location-lookups/95746/5 "2017-08-31T21:50:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.