# Geo ip not appearing in Kibana

**URL:** <https://discuss.elastic.co/t/geo-ip-not-appearing-in-kibana/214551>\
**Category:** Kibana\
**Created:** [January 10, 2020, 7:34am UTC](https://discuss.elastic.co/t/geo-ip-not-appearing-in-kibana/214551 "2020-01-10T07:34:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jayanth\_S\_N](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jayanth_s_n/32/60308_2.png) [@Jayanth\_S\_N](https://discuss.elastic.co/u/Jayanth_S_N)\
**Post date:** [January 10, 2020, 7:34am UTC](https://discuss.elastic.co/t/geo-ip-not-appearing-in-kibana/214551/1 "2020-01-10T07:34:13Z")

</div>

I am trying to load the logs into the elasticsearch from Kafka below is my config file.

```
input {
kafka { bootstrap_servers => "localhost:9092"
            topics => ["elk104"] }}                                                                                                                    
filter{
mutate {
  add_field => { "tmp_message" => "%{message}" }
  split => ["message", "|"]
  add_field => { "cef_version" => "%{[message][0]}" }
  add_field => { "cef_device_vendor" => "%{[message][1]}" }
  add_field => { "cef_device_product" => "%{[message][2]}" }
  add_field => { "cef_device_version" => "%{[message][3]}" }
  add_field => { "cef_sig_id" => "%{[message][4]}" }
  add_field => { "cef_sig_name" => "%{[message][5]}" }
  add_field => { "cef_sig_severity" => "%{[message][6]}" }
} kv {
     field_split => ","
     trim_key => "<>\[\],"
     trim_value => "<>\[\],"
     include_keys => []
}mutate {
    rename => ["src", "cef_traffic_src_ip"]
    replace => { "message" => "%{tmp_message}" }
    remove_field => ["tmp_message"]} geoip {
    source => "cef_traffic_src_ip"}mutate {
     rename => {
            "longitude" => "[location][lon]"
            "latitude" => "[location][lat]"}
    convert => {"[location][lat]" => "float"}
    convert => {"[location][lon]" => "float"}}}output {elasticsearch {
  hosts => ["localhost:9200"]
  index => "pioneer01-logstash"
  template_name=>"elk_template"
  workers => 1
}}

```

and for the template, I am using below configuration,

```
 PUT _template/elk_template
{
  "index_patterns": ["pioneer-*"],
  "settings": {
    "index": {
        "refresh_interval": "5s"
    }
  },
  "mappings": {
      "dynamic_templates": [
          {
            "message_field": {
              "path_match": "message",
              "match_mapping_type": "string",
              "mapping": {
                "type": "text",
                "norms": false
              }
            }
          },
          {
            "string_fields": {
              "match": "*",
              "match_mapping_type": "string",
              "mapping": {
                "type": "text",
                "norms": false,
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              }
            }
          }
        ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "@version": {
          "type": "keyword"
        },
        "location": {
          "type": "geo_point"
        },
        "tags": {
          "type": "keyword"
        },
        "latitude" : { 
          "type" : "half_float" 
        },
        "longitude" : { 
          "type" : "half_float" 
        },
        "ip": { 
          "type": "ip" 
        }
      }
  },
  "aliases": {}
}

```

Still, when I look at the output in elasticsearch I can get the GeoIP results,

```
"geoip" : {
        "city_name" : "Bucharest",
        "country_code3" : "RO",
        "region_code" : "B",
        "timezone" : "Europe/Bucharest",
        "ip" : "93.114.45.13",
        "latitude" : 44.4354,
        "continent_code" : "EU",
        "country_code2" : "RO",
        "region_name" : "Bucuresti",
        "postal_code" : "052822",
        "country_name" : "Romania",
        "longitude" : 26.1033,
        "location" : {
          "lat" : 44.4354,
          "lon" : 26.1033
        }
      }

```

But, when I try to create the dashboard in Kibana, I don't get the mapping of the points on the map there. can somebody help me with this?

 ![Screenshot 2020-01-10 at 1.01.40 PM](https://us1.discourse-cdn.com/elastic/original/3X/5/2/52c88f759bf7d85505aff062f2b0ee6cf057e3c3.jpeg)

---

<div class="post-metadata">

**Author:** ![ming1997](https://avatars.discourse-cdn.com/v4/letter/m/74df32/32.png) [@ming1997](https://discuss.elastic.co/u/ming1997)\
**Post date:** [January 10, 2020, 7:56am UTC](https://discuss.elastic.co/t/geo-ip-not-appearing-in-kibana/214551/2 "2020-01-10T07:56:42Z")

</div>

you can see the location field in management=\>index pattern, may be it is conflicted

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 7, 2020, 7:56am UTC](https://discuss.elastic.co/t/geo-ip-not-appearing-in-kibana/214551/3 "2020-02-07T07:56:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.