# Example geoip config that works LS/ES 5.1

**URL:** <https://discuss.elastic.co/t/example-geoip-config-that-works-ls-es-5-1/71394>\
**Category:** Logstash\
**Created:** [January 12, 2017, 3:02pm UTC](https://discuss.elastic.co/t/example-geoip-config-that-works-ls-es-5-1/71394 "2017-01-12T15:02:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![paka](https://avatars.discourse-cdn.com/v4/letter/p/898d66/32.png) [@paka](https://discuss.elastic.co/u/paka)\
**Post date:** [January 12, 2017, 3:02pm UTC](https://discuss.elastic.co/t/example-geoip-config-that-works-ls-es-5-1/71394/1 "2017-01-12T15:02:00Z")

</div>

Hello,

please does geoip work for someone in LS and ES 5.1, is there an example of configuration that works ?

I'm fighting with it whole day, trying all various things found in many issues also others apparently have with that, but nothing helps...

My last attempt is a minimalistic one - in logstash filter I have just:

geoip {  
source =\> "[attrs][source]"  
target =\> "geoip"  
}

and in mapping template:

"geoip" : {  
"type" : "object",  
"dynamic": true,  
"properties" : {  
"ip": { "type": "ip" },  
"location" : { "type" : "geo\_point" },  
"latitude" : { "type" : "float" },  
"longitude" : { "type" : "float" }  
}  
}

but still I get error:  
"error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse", "caused\_by"=\>{"type"=\>"parse\_exception", "reason"=\>"geo\_point expected"}

Thanks in advance for your help,  
Pavel

---

<div class="post-metadata">

**Author:** ![Troy\_C](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/troy_c/32/14509_2.png) [@Troy\_C](https://discuss.elastic.co/u/Troy_C)\
**Post date:** [January 12, 2017, 3:05pm UTC](https://discuss.elastic.co/t/example-geoip-config-that-works-ls-es-5-1/71394/2 "2017-01-12T15:05:18Z")

</div>

Something like this works for me

> ```
> geoip {
> source => "dst_ip"
> target => "geoip"
> add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
> add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
> }
> mutate {
> convert => ["[geoip][coordinates]", "float"]
> }
> 
> ```

---

<div class="post-metadata">

**Author:** ![paka](https://avatars.discourse-cdn.com/v4/letter/p/898d66/32.png) [@paka](https://discuss.elastic.co/u/paka)\
**Post date:** [January 12, 2017, 3:35pm UTC](https://discuss.elastic.co/t/example-geoip-config-that-works-ls-es-5-1/71394/3 "2017-01-12T15:35:08Z")

</div>

Thanks - I tried that, but got the same error as previously.

I tried also adding the following to the mapping:  
"location" : { "type" : "geo\_point", "ignore\_malformed": true }  
but the error is still the same, strange.

---

<div class="post-metadata">

**Author:** ![paka](https://avatars.discourse-cdn.com/v4/letter/p/898d66/32.png) [@paka](https://discuss.elastic.co/u/paka)\
**Post date:** [January 13, 2017, 9:39am UTC](https://discuss.elastic.co/t/example-geoip-config-that-works-ls-es-5-1/71394/4 "2017-01-13T09:39:04Z")

</div>

Here is example data that I see coming out from logstash (using rybydebug output):

"geoip" =\> {  
"timezone" =\> "Asia/Colombo",  
"ip" =\> "112.135.80.183",  
"latitude" =\> 6.6,  
"coordinates" =\> [  
[0] 79.95,  
[1] 6.6  
],  
"continent\_code" =\> "AS",  
"city\_name" =\> "Kalutara North",  
"country\_code2" =\> "LK",  
"country\_name" =\> "Sri Lanka",  
"country\_code3" =\> "LK",  
"region\_name" =\> "Western Province",  
"location" =\> [  
[0] 79.95,  
[1] 6.6  
],  
"postal\_code" =\> "12000",  
"longitude" =\> 79.95,  
"region\_code" =\> "1"  
},

The geoip.location seems to be array of two numbers, which according to doc should be one of valid formats of geo\_point ES data type. But ES still refuses it with error  
"type"=\>"p"type"=\>"parse\_exception", "reason"=\>"geo\_point expected"arse\_exception", "reason"=\>"geo\_point expected"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 10, 2017, 9:39am UTC](https://discuss.elastic.co/t/example-geoip-config-that-works-ls-es-5-1/71394/5 "2017-02-10T09:39:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.