# Feed GeoLocation over WAN

**URL:** <https://discuss.elastic.co/t/feed-geolocation-over-wan/96636>\
**Category:** Beats\
**Created:** [August 10, 2017, 3:27pm UTC](https://discuss.elastic.co/t/feed-geolocation-over-wan/96636 "2017-08-10T15:27:21Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dami](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@Dami](https://discuss.elastic.co/u/Dami)\
**Post date:** [August 10, 2017, 3:27pm UTC](https://discuss.elastic.co/t/feed-geolocation-over-wan/96636/1 "2017-08-10T15:27:21Z")

</div>

Is there any way I can get client location without GeoIP ingest plugin?  
I'm using the available modules for filebeat and metricbeat, and also about to include heartbeat and packetbeat.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 10, 2017, 9:05pm UTC](https://discuss.elastic.co/t/feed-geolocation-over-wan/96636/2 "2017-08-10T21:05:15Z")

</div>

> [@Dami](#):
>
> Is there any way I can get client location without GeoIP ingest plugin?

You can use Logstash with the geoip filter.

---

<div class="post-metadata">

**Author:** ![Dami](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@Dami](https://discuss.elastic.co/u/Dami)\
**Post date:** [August 14, 2017, 5:43pm UTC](https://discuss.elastic.co/t/feed-geolocation-over-wan/96636/3 "2017-08-14T17:43:21Z")

</div>

Thanks for your response.  
I'm trying to keep logstash out of the ecuation for now, so I'm trying to do it with Elasticsearch and Beat. I found JimCheetham post about generating a filter with mutate and geoip in logstash but if I can help it will be better.  
Maybe the "hardcoded" localization can be added in a custom field to a Module over the Beat configuration.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 14, 2017, 11:16pm UTC](https://discuss.elastic.co/t/feed-geolocation-over-wan/96636/4 "2017-08-14T23:16:03Z")

</div>

Then Elasticsearch has [https://www.elastic.co/guide/en/elasticsearch/plugins/current/ingest-geoip.html](https://www.elastic.co/guide/en/elasticsearch/plugins/current/ingest-geoip.html)

---

<div class="post-metadata">

**Author:** ![Dami](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@Dami](https://discuss.elastic.co/u/Dami)\
**Post date:** [August 16, 2017, 4:10pm UTC](https://discuss.elastic.co/t/feed-geolocation-over-wan/96636/5 "2017-08-16T16:10:23Z")

</div>

Hi Warkolm,  
I don't understand what you mean, I've already stated that it couldn't be done with GeoIP ingest plugin since it is a WAN.  
So i'm trying to do it over the beat client or adjusting maxmind GeoIP database to include my private IP addresses. The foremost doesn't seem to support custom fields like that and I'm not sure how to generate a new maxmind db since they seem to be a propietary type binary (mmdb).  
I will try this solution soon:

> **[maxmind/MaxMind-DB-Writer-perl](https://github.com/maxmind/MaxMind-DB-Writer-perl)**
>
> MaxMind-DB-Writer-perl - Create MaxMind DB database files

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 16, 2017, 8:43pm UTC](https://discuss.elastic.co/t/feed-geolocation-over-wan/96636/6 "2017-08-16T20:43:11Z")

</div>

> [@Dami](#):
>
> I don’t understand what you mean, I’ve already stated that it couldn’t be done with GeoIP ingest plugin since it is a WAN

Don't you mean LAN then?

---

<div class="post-metadata">

**Author:** ![Dami](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@Dami](https://discuss.elastic.co/u/Dami)\
**Post date:** [August 16, 2017, 9:42pm UTC](https://discuss.elastic.co/t/feed-geolocation-over-wan/96636/7 "2017-08-16T21:42:46Z")

</div>

It is not a LAN. I should have done a better introduction perhaps.  
In question:  
1- I have private IP addresses that I need to monitor and present over a map.  
2- I would like to extend Beat or Maxmind functionalities to include Geolocation with private IP but avoiding to install a logstash node to generate them thru filters.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 16, 2017, 9:44pm UTC](https://discuss.elastic.co/t/feed-geolocation-over-wan/96636/8 "2017-08-16T21:44:29Z")

</div>

Thanks, that does make things clearer.

In this case you will need Logstash to do this as it is not anything beats can, or likely will, do.

---

<div class="post-metadata">

**Author:** ![Dami](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@Dami](https://discuss.elastic.co/u/Dami)\
**Post date:** [August 16, 2017, 9:45pm UTC](https://discuss.elastic.co/t/feed-geolocation-over-wan/96636/9 "2017-08-16T21:45:12Z")

</div>

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2017, 3:27pm UTC](https://discuss.elastic.co/t/feed-geolocation-over-wan/96636/10 "2017-08-31T15:27:28Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.
