# Filebeat \>5.4: Apply geoip only if a IP field exists

**URL:** <https://discuss.elastic.co/t/filebeat-5-4-apply-geoip-only-if-a-ip-field-exists/118684>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 6, 2018, 4:37pm UTC](https://discuss.elastic.co/t/filebeat-5-4-apply-geoip-only-if-a-ip-field-exists/118684 "2018-02-06T16:37:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dao](https://avatars.discourse-cdn.com/v4/letter/d/a6a055/32.png) [@dao](https://discuss.elastic.co/u/dao)\
**Post date:** [February 6, 2018, 4:37pm UTC](https://discuss.elastic.co/t/filebeat-5-4-apply-geoip-only-if-a-ip-field-exists/118684/1 "2018-02-06T16:37:12Z")

</div>

I listen to my app with a filebeat that watches the application logs. To parse my custom log lines, I have a pipeline in my elasticsearch \_ingest.

Some of the lines have a IP address, some others have not. I want to geoip the IP address. but it seems to fail. How can I run the geoip only if there is a IP field? I have tried:

- create 2 prospectors and add a field. But the 2 prospectors are on the same log file, which makes filebeat fail ([https://www.elastic.co/guide/en/beats/filebeat/current/multiple-prospectors.html](https://www.elastic.co/guide/en/beats/filebeat/current/multiple-prospectors.html))
- create a processor, but I did not find a way to add a field with it

any solution? I cannot imagine I have to use logstash?

Here is my pipeline

```auto
    "processors": [
      {
        "grok": {
          "field": "message",
          "patterns": [
            "%{TIMESTAMP_ISO8601:logdate},... %{LOGLEVEL:level} +~ %{EMAILLOCALPART:who}@%{HOSTNAME:company} ..%{IPORHOST:ip}..: .....%{URIPATHPARAM:route} performed in %{INT:req_ms:int} ms",
            "%{TIMESTAMP_ISO8601:logdate},... %{LOGLEVEL:level} +~ perfutils layout#%{INT:decode_layout:int} msg#%{INT:decode_msg:int} decode:%{INT:decode_ms:int}ms IFTs:%{INT:ifts_ms:int}ms",
            "%{TIMESTAMP_ISO8601:logdate},... %{LOGLEVEL:level} +~ %{GREEDYDATA:text}"
          ]
        }
      },
      {
        "geoip" : {
          "field" : "ip"
        }
      }
    ]
  

```

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [February 6, 2018, 5:41pm UTC](https://discuss.elastic.co/t/filebeat-5-4-apply-geoip-only-if-a-ip-field-exists/118684/2 "2018-02-06T17:41:29Z")

</div>

Hi @dao,

It looks like you could use the `ignore_missing` setting from the `geoip` processor? [https://www.elastic.co/guide/en/elasticsearch/plugins/current/using-ingest-geoip.html](https://www.elastic.co/guide/en/elasticsearch/plugins/current/using-ingest-geoip.html)

Best regards

---

<div class="post-metadata">

**Author:** ![dao](https://avatars.discourse-cdn.com/v4/letter/d/a6a055/32.png) [@dao](https://discuss.elastic.co/u/dao)\
**Post date:** [February 6, 2018, 8:42pm UTC](https://discuss.elastic.co/t/filebeat-5-4-apply-geoip-only-if-a-ip-field-exists/118684/3 "2018-02-06T20:42:03Z")

</div>

great, I missed this one!

Olivier Dao Hodac  
_FlightWatching_

+33 6 76 81 54 11

The information in this e-mail is confidential. The contents may not be  
disclosed or used by anyone other than the addressee. Access to this e-mail  
by anyone else is not authorised.  
If you are not the intended recipient, please notify FlightWatching SAS  
immediately and delete this e-mail.  
FlightWatching SAS cannot accept any responsibility for the accuracy or  
completeness of this e-mail as it has been sent over public networks. If  
you have any concerns over the content of this message or its Accuracy or  
Integrity, please contact FlightWatching SAS immediately.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2018, 8:42pm UTC](https://discuss.elastic.co/t/filebeat-5-4-apply-geoip-only-if-a-ip-field-exists/118684/4 "2018-03-06T20:42:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.