# Field geoip.location not created in index winlogbeat-\*

**URL:** <https://discuss.elastic.co/t/field-geoip-location-not-created-in-index-winlogbeat/129652>\
**Category:** Elasticsearch\
**Created:** [April 26, 2018, 11:49am UTC](https://discuss.elastic.co/t/field-geoip-location-not-created-in-index-winlogbeat/129652 "2018-04-26T11:49:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Edouard\_Fazenda](https://avatars.discourse-cdn.com/v4/letter/e/b19c9b/32.png) [@Edouard\_Fazenda](https://discuss.elastic.co/u/Edouard_Fazenda)\
**Post date:** [April 26, 2018, 11:49am UTC](https://discuss.elastic.co/t/field-geoip-location-not-created-in-index-winlogbeat/129652/1 "2018-04-26T11:49:35Z")

</div>

Dear Community,

I have put in place in my ELK Stack the collect of Windows Security Logs with the beat agent winlogbeat, this is working but now i want to create a coordinate or region map using geoip,

I put in my logstash configuration for beats the following :

```
filter {
    geoip {
        source => "[event_data][IpAddress]"
    }
}

```

Updating my winlogbeat-\* template to support geoip

Following this documentation : [https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat](https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat)

But unfortunatly i have the fields geoip.location.lat and geoip.location.lon but no geoip.location field of type geo\_ip

Did I miss something ?

Thanks in advance.

Best Regards, Edouard Fazenda.

---

<div class="post-metadata">

**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\
**Post date:** [May 4, 2018, 3:23pm UTC](https://discuss.elastic.co/t/field-geoip-location-not-created-in-index-winlogbeat/129652/2 "2018-05-04T15:23:44Z")

</div>

@Edouard_Fazenda did you follow the part of [Monitoring Windows Logons with Winlogbeat | Elastic Blog](https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat) that starts with

> And because we are indexing a new field in our events we need to enhance the Elasticserach index template used for the Winlogbeat data. Install this template to Elasticsearch before indexing events containing the geoip fields.

If you didn't, you will need to recreate this index or use another field. It looks like the `geoip` field is already mapped improperly, so you cannot fix it on existing index.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 1, 2018, 3:23pm UTC](https://discuss.elastic.co/t/field-geoip-location-not-created-in-index-winlogbeat/129652/3 "2018-06-01T15:23:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.