# GeoIP enrichment not working **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [June 6, 2021, 11:41pm UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084 "2021-06-06T23:41:48Z")\ **Posts on this page:** 12\ **Page:** 2
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [June 7, 2021, 4:23pm UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084/21 "2021-06-07T16:23:01Z")
The Cloud Auth / Id looks good Nope ```auto output.elasticsearch: # Boolean flag to enable or disable the output module. enabled: true pipeline: geoip-info ``` or shorthand ``` output.elasticsearch.enabled: true output.elasticsearch.pipeline: geoip-info ``` gotta run ... good luck! ---
**Author:** ![farciarz121](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Post date:** [June 7, 2021, 4:39pm UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084/22 "2021-06-07T16:39:30Z")
uugghhhh... it is killing me ... 😃 This won't let me sleep. Have a good one! ---
**Author:** ![farciarz121](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Post date:** [June 7, 2021, 6:25pm UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084/23 "2021-06-07T18:25:30Z")
> [@stephenb](#): > > gotta run ... good luck! Check this out 😃 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef5645e9429665786b4a0482d5d1c5211233da75.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [June 7, 2021, 8:28pm UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084/24 "2021-06-07T20:28:35Z")
NICE!!! What was the fix? If you want to run it through logstash we can do that but I am OOO rest of the day. I can show you how... it is in those links above ... > [@stephenb](#): > > Logstash see [here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html) ... I am not sure that is going to be easier but give it a try.. ---
**Author:** ![farciarz121](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Post date:** [June 7, 2021, 9:22pm UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084/25 "2021-06-07T21:22:47Z")
There was none... I knew this was not conf issue, because it worked with the same configuration on your end. It was not, firewall issue, because beat was able to connect and send traffic to elastic. I got frustrated and I set up a new VM with win 10. I did exactly same thing and it worked as a charm. This makes me think that maybe the service that was initially set up was not fully uninstalled after reconfiguration ... who knows, I am glad it works. > [@stephenb](#): > > If you want to run it through logstash we can do that but I am OOO rest of the day. Sure, if you have time I will be happy to learn how to do this tomorrow. I will read links you provided, and do my best to set this up. If I bump into problems, I will reach out to you. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [June 8, 2021, 4:50am UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084/26 "2021-06-08T04:50:34Z")
To use Logstash in the packetbeat.yml. 1. comment out the elasticsearch output and cloud auth id 2. set the logstash output and pipeline ```auto output.logstash: # The Logstash hosts hosts: ["localhost:5044"] pipeline : geoip-info ``` 1. Use this for your logstash.conf. This acts as a pass through and forwards the pipeline definition ```auto ################################################ # beats->logstash->es default config. ################################################ input { beats { port => 5044 } } output { if [@metadata][pipeline] { elasticsearch { cloud_auth => "elastic:password" cloud_id => "mycloud:dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRj......" manage_template => false index => "%{[@metadata][beat]}-%{[@metadata][version]}" pipeline => "%{[@metadata][pipeline]}" } } else { elasticsearch { cloud_auth => "elastic:password" cloud_id => "mycloud:dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRj......" manage_template => false index => "%{[@metadata][beat]}-%{[@metadata][version]}" } } } ``` ---
**Author:** ![farciarz121](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Post date:** [June 8, 2021, 11:24am UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084/27 "2021-06-08T11:24:27Z")
Yes, this is exactly how I have logstash.conf set up. Here I have a question. My understanding is that if elastic has 2,3,5...20 pipelines, it needs to separate them. Does it mean that it also needs to balance traffic? How does it choose which pipeline to take care of first? Lets say I have 4 different clusters on different pipelines to make it more interesting one sending traffic from Canada one from the USA, and they both send traffic to the same Elastic cloud. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [June 8, 2021, 12:51pm UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084/28 "2021-06-08T12:51:27Z")
> [@farciarz121](#): > > My understanding is that if elastic has 2,3,5...20 pipelines, i I assume you mean My understanding is that if **Logstash** has 2,3,5...20 pipelines, i.... In short please open seperate topic on these questions there are some very good Logstash people on the forum. I would also suggest some of these topics in the documentation. > **[Advanced Logstash Configurations | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/configuration-advanced.html)** > **[Deploying and Scaling Logstash | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/deploying-and-scaling.html)** If you you are really saying how ingest pipelines work in elasticsearch in Elastic Cloud it is a distributed system, with a proxy, with a multiple queues, first come first serve, with prioritization and parallelization.... and a whole lot of configuration settings. If you want more than that you are probably going to need to look at the code, or perform some actual setup and then ask specific questions. And course proper configuration like using coordinators scaling and performance tuning are part of this equation as well Just for clarity if you run a self managed cluster, best practice is to load balance request, but even with that understanding how elastic works under the cover with distributing index and query might be worth learning a bit. [This is super old](https://www.elastic.co/guide/en/elasticsearch/guide/current/index.html) but still very good for those concepts but be careful syntax is sometimes no longer valid. Also in your questions since there are logstash pipelines and ingest pipeline please be specific to which you are referring to as both can be used or not Good Luck come back with some specifics. ---
**Author:** ![farciarz121](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Post date:** [June 8, 2021, 5:15pm UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084/29 "2021-06-08T17:15:08Z")
> [@stephenb](#): > > set the logstash output and pipeline I have a question over here. Logstash .yml has an entry under Pipeline settings with `pipeline.id: main` Having this in mind, we want to push logs from packet beat through logstash using geoip-info pipeline. At the same time I am using different beats to send logs using logstash with main pipeline. How do I configure logstash to handle this ? Can I simply do `pipeline.id: main, geoip-info` ? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [June 8, 2021, 5:26pm UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084/30 "2021-06-08T17:26:52Z")
You are confusing and ingest pipeline with logstash pipeline... 2 different things completely, but often confused. The pipelines referred to in logstasg pipelines.yml are logstash pipelines not the geoip-info pipelines. Highly encourage you to open specific threads on specific logstash questions. Logstash has pipelines... In those pipelines in the output section you can define to run an ingest pipeline in elasticsearch This code above ```auto pipeline => "%{[@metadata][pipeline]}" ``` Says run the ingest pipeline I defined in the beats in elastic. That whole logstash.conf is a logstash pipeline. ---
**Author:** ![farciarz121](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Post date:** [June 8, 2021, 5:56pm UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084/31 "2021-06-08T17:56:39Z")
> [@stephenb](#): > > Says run the ingest pipeline I defined in the beats in elastic. > That whole logstash.conf is a logstash pipeline. Got you that makes perfect sense. Also, I moved logstash problem to another threat. `https://discuss.elastic.co/t/logstash-communication-configuration/275331` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2021, 7:57pm UTC](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084/32 "2021-07-06T19:57:30Z")
Closed on July 6, 2021, 7:57pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/geoip-enrichment-not-working/275084.md?page=1)