# Geo\_Point and Logstash

**URL:** <https://discuss.elastic.co/t/geo-point-and-logstash/198066>\
**Category:** Logstash\
**Created:** [September 4, 2019, 2:25pm UTC](https://discuss.elastic.co/t/geo-point-and-logstash/198066 "2019-09-04T14:25:00Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![SteveSmith](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@SteveSmith](https://discuss.elastic.co/u/SteveSmith)\
**Post date:** [September 4, 2019, 2:25pm UTC](https://discuss.elastic.co/t/geo-point-and-logstash/198066/1 "2019-09-04T14:25:00Z")

</div>

Hi Everyone,

I am having a hard time lately understanding how the Geo\_Point type is created. I found that when I create the pipeline (using this link: [https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-geoip.html](https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-geoip.html)) and ship Packetbeat directly to the cluster I get the Geo\_Point data type. But, if i run Packetbeat though Logstash, well that data type is never created. From my limited understanding, it seems that ES would create this when data is shipped to the pipeline, which confuses me as to why it would matter who does the shipping. Below is the config file i am using for Logstash, any help on this would be wonderful.

```
input {
    beats {
        port => 5044
    }
}
filter {
    if [agent][type] == "packetbeat" {
        if ("xxx.xxx" in [client][ip] or "xxx.xxx" in [client][ip]) and ("xxx.xxx" in [server][ip] or "xxx.xxx" in [server][ip]) {
            mutate {
                add_field => {"traffic_direction" => "Internal"}
            }
        }
        else if "xxx.xxx" in [server][ip] or "xxx.xxx" in [server][ip] {
            mutate {
                add_field => {"traffic_direction" => "Inbound"}
            }
        }
        else if "xxx.xxx" in [client][ip] or "xxx.xxx" in [client][ip] {
            mutate {
                add_field => {"traffic_direction" => "Outbound"}
            }
        }
        else {
            mutate {
                add_field => {"traffic_direction" => "Unkonwn"}
            }
        }
    }
}
output {
    elasticsearch {
        hosts => "https://XXXXXXXXXXXX.us-east-1.aws.found.io:9243"
        user => "elastic"
        password => "xxxxxxx"
        index => "%{[@metadata][beat]}-%{[@metadata][version]}"
        pipeline => "geoip-info"
    }
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 4, 2019, 3:11pm UTC](https://discuss.elastic.co/t/geo-point-and-logstash/198066/2 "2019-09-04T15:11:08Z")

</div>

Are you aware that there is a [cidr](https://www.elastic.co/guide/en/logstash/current/plugins-filters-cidr.html) filter that can do network matching?

It is not clear to me that client.ip in the pipeline configuration refers to what we would reference as [client][ip] in logstash. It might be a field with a period in the name.

---

<div class="post-metadata">

**Author:** ![SteveSmith](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@SteveSmith](https://discuss.elastic.co/u/SteveSmith)\
**Post date:** [September 4, 2019, 3:35pm UTC](https://discuss.elastic.co/t/geo-point-and-logstash/198066/3 "2019-09-04T15:35:53Z")

</div>

I didn't know that there was a cidr filter for logstash, might be helpful for my if statements. But, would that cause the the problem with the geo\_point? I have tested in the past without the filter section in the config and still had the same problem with the geo\_point.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 4, 2019, 3:52pm UTC](https://discuss.elastic.co/t/geo-point-and-logstash/198066/4 "2019-09-04T15:52:35Z")

</div>

> [@SteveSmith](#):
>
> would that cause the the problem with the geo\_point?

No. As I said, I suspect a mismatch of the field names.

You could do the enrichment using a [geoip](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html) filter rather than a pipeline.

---

<div class="post-metadata">

**Author:** ![SteveSmith](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@SteveSmith](https://discuss.elastic.co/u/SteveSmith)\
**Post date:** [September 4, 2019, 6:11pm UTC](https://discuss.elastic.co/t/geo-point-and-logstash/198066/5 "2019-09-04T18:11:13Z")

</div>

Would that be the preferred way? I am still a bit new to things in the stack and I really only had an issue with the geo enrichment part of this. Those filters work for the most part but they are not the issue i have had. It was mainly losing that geo\_point info when pushing Packetbeat though Logstash compared to having Packetbeat send direct to ES.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 4, 2019, 6:17pm UTC](https://discuss.elastic.co/t/geo-point-and-logstash/198066/6 "2019-09-04T18:17:51Z")

</div>

> [@SteveSmith](#):
>
> Would that be the preferred way?

Whatever works is the preferred way to me 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 2, 2019, 6:28pm UTC](https://discuss.elastic.co/t/geo-point-and-logstash/198066/7 "2019-10-02T18:28:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.