# Проблема с выводом данных geo\_point в ELK **URL:** \ **Category:** Вопросы на русском языке\ **Created:** [October 30, 2020, 1:01pm UTC](https://discuss.elastic.co/t/geo-point-elk/253822 "2020-10-30T13:01:14Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Mihail982012](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Mihail982012](https://discuss.elastic.co/u/Mihail982012)\ **Post date:** [October 30, 2020, 1:01pm UTC](https://discuss.elastic.co/t/geo-point-elk/253822/1 "2020-10-30T13:01:14Z")
Добрый день! У меня есть необходимость обработать собственные данные некоторых логов Пример: `86.250.174.21 65507 191.96.36.126 30494 ExploitAttempt 6` Данные поступают в Logstash, его конфиг: ```auto filter { grok { match => [ "message" , "%{IPORHOST:source_ip} %{NUMBER:source_port} %{IPORHOST:dst_ip} %{NUMBER:dst_port} %{DATA:Attack} %{NUMBER:SID:INT}"] } geoip { source => "source_ip" target => "geoip_src" add_field => {"[geoip_src][coordinates]" => "%{[geoip_src][longitude]}"} add_field => {"[geoip_src][coordinates]" => "%{[geoip_src][latitude]}"} } geoip { source => "dst_ip" target => "geoip_dst" add_field => {"[geoip_dst][coordinates]" => "%{[geoip][longitude]}"} add_field => {"[geoip_dst][coordinates]" => "%{[geoip][latitude]}"} } mutate { remove_field => ["message"] } } ``` Для вывода данных на Coordinate Map, перед отправкой первых данных, я прописываю в \> Dev Tools в Kibana шаблон индекса, в котором указываю тип данных "geo\_point" для полей location (ft\_2 - название индекса): ```auto PUT ft_2 { "settings": { "number_of_shards": 5, "number_of_replicas": 1 }, "mappings": { "doc": { "properties": { "@timestamp": { "type": "date" }, "@version": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "Attack": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "SID": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "dst_ip": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "dst_port": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "geoip_dst": { "properties": { "city_name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "continent_code": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "coordinates": { "type": "geo_point", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "country_code2": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "country_code3": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "country_name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "dma_code": { "type": "long" }, "ip": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "latitude": { "type": "geo_point" }, "location": { "properties": { "lat": { "type": "geo_point" }, "lon": { "type": "geo_point" } } }, "longitude": { "type": "geo_point" }, "postal_code": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "region_code": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "region_name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "timezone": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } } } }, "geoip_src": { "properties": { "city_name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "continent_code": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "coordinates": { "type": "geo_point", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "country_code2": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "country_code3": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "country_name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "dma_code": { "type": "long" }, "ip": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "latitude": { "type": "geo_point" }, "location": { "properties": { "lat": { "type": "geo_point" }, "lon": { "type": "geo_point" } } }, "longitude": { "type": "geo_point" }, "postal_code": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "region_code": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "region_name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "timezone": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } } } }, "host": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "level": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "logger_name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "path": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "port": { "type": "long" }, "source_ip": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "source_port": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "tags": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "type": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } } } } } } ``` После чего, отправляю сообщения и приходит следующий формат в JSON: ```auto { "_index": "ft_2", "_type": "doc", "_id": "KqxweXUBBkwPoRozDahM", "_version": 1, "_score": null, "_source": { "geoip_src": {}, "stack_info": null, "type": "logstash", "tags": [ "_geoip_lookup_failure" ], "SID": "0", "source_port": "34450", "@version": "1", "dst_ip": "248.115.207.180", "level": "INFO", "geoip_dst": {}, "path": "c:\\TCP Data Logstash.py", "dst_port": "54710", "host": "111", "@timestamp": "2020-10-30T12:16:26.662Z", "logger_name": "python-logstash-logger", "source_ip": "251.95.83.212", "Attack": "TorrentBit", "port": 54323 }, "fields": { "@timestamp": [ "2020-10-30T12:16:26.662Z" ] }, "sort": [ 1604060186662 ] } ``` Однако, если не указывать в шаблоне индекса тип данных "geo\_point", то все данные приходят и видны, однако их нельзя использовать в Coordinate Map. Помогите пожалуйста устранить эту проблему. ---
**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\ **Post date:** [October 30, 2020, 8:07pm UTC](https://discuss.elastic.co/t/geo-point-elk/253822/2 "2020-10-30T20:07:13Z")
Тут ключевой момент такой: > [@Mihail982012](#): > > ```auto > "tags": [ > "_geoip_lookup_failure" > ], > > ``` Это означает, что для этого IP определить месторасположения не удалось, что вобщем-то и понятно, так как все IP из диапазона `240.0.0.0/4` зарезервированы, так что машин с таким адресом в интернете существовать не должно. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 27, 2020, 8:07pm UTC](https://discuss.elastic.co/t/geo-point-elk/253822/3 "2020-11-27T20:07:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.