# Geoip field is not showing in dashboard **URL:** \ **Category:** Logstash\ **Created:** [January 11, 2017, 11:08am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205 "2017-01-11T11:08:42Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![shubhrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhrant/32/20310_2.png) [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Post date:** [January 11, 2017, 11:08am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/1 "2017-01-11T11:08:42Z")
I'm trying to locate the geo location on apache server but the geoip field is not showing this is logstash configuration file input { beats { port =\> 5044 } } filter { if [type] == "apache" { grok { match =\> { "message" =\> "%{COMBINEDAPACHELOG}" } } geoip { source =\> "clientip" } } } output { elasticsearch { hosts =\> ["localhost:9200"] } } and the raw log is "- - - [11/Jan/2017:16:30:41 +0530] "GET /report\_generator\_hartron/index.php HTTP/1.1" 200 596 "-" "Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/55.0.2883.87 Chrome/55.0.2883.87 Safari/537.36"" ![](https://us1.discourse-cdn.com/elastic/original/2X/2/2e322c9e4b3204580e3d8271a3f1530201d7a259.png) 1 more thing I want to tell that when I added this geoip field into logstash filter then under tag section one error is coming i.e. "geoip\_lookup\_failure" ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 11, 2017, 3:20pm UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/2 "2017-01-11T15:20:54Z")
The geoip filter fails because there is no clientip field. There's no clientip field because the grok filter fails. The grok filter fails because - in the text example you gave there is no clientip field, and - in the screenshot the log clearly isn't in Combined format. ---
**Author:** ![shubhrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhrant/32/20310_2.png) [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Post date:** [January 12, 2017, 5:14am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/3 "2017-01-12T05:14:22Z")
sorry for the late reply ... Actually Now I've made some changes in the apache configuration file and the client IP field is now coming you can check the screenshot ![](https://us1.discourse-cdn.com/elastic/original/2X/9/9f8883c12a4c68204a1d692f39a219f591173c0d.png) but still the same problem with geoIP and now log message looks like "xxx.xxx.xxx.77 - - [12/Jan/2017:10:36:39 +0530] "GET /report\_generator\_hartron/pagination.js HTTP/1.1" 404 532 "[http://xx.xx.xx.xx/report\_generator\_hartron/showreport.php](http://xx.xx.xx.xx/report_generator_hartron/showreport.php)" "Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/55.0.2883.87 Chrome/55.0.2883.87 Safari/537.36" " ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 12, 2017, 6:56am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/4 "2017-01-12T06:56:27Z")
GeoIP lookups don't work for RFC1918 addresses like 10.228.12.77. ---
**Author:** ![shubhrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhrant/32/20310_2.png) [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Post date:** [January 12, 2017, 6:59am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/5 "2017-01-12T06:59:43Z")
So what should I do for this sir..? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 12, 2017, 7:04am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/6 "2017-01-12T07:04:08Z")
Perhaps you can use the translate filter to map your 10.0.0.0/8 addresses to geographic locations? If you don't want to list all possible addresses then the cidr filter should be helpful. A combination of the two might be the best option. You obviously need to obtain and maintain the mapping between your 10.0.0.0/8 addresses and geolocations. Nobody can help you with that. ---
**Author:** ![shubhrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhrant/32/20310_2.png) [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Post date:** [January 12, 2017, 7:12am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/7 "2017-01-12T07:12:41Z")
Ok I put one sample file for apache logs which has ip address like 46.119.114.245 ![](https://us1.discourse-cdn.com/elastic/original/2X/3/39323c9b218f2937d1ef3e65bb4e6793f16c4d23.png) Still geoip field is not reflecting And this is the logstash log message if you need it [2017-01-12T10:31:24,619][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}} ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 12, 2017, 7:16am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/8 "2017-01-12T07:16:38Z")
I don't know what's up in your case. You're not getting a `_geoip_lookup_failure` tag so it looks like it's succeeding. Also, it works fine for me with Logstash 2.4.0: ```plaintext $ echo '46.119.114.245' | /opt/logstash/bin/logstash -e 'input { stdin {} } filter { geoip { source => "message" } } output { stdout { codec => rubydebug } }' Settings: Default pipeline workers: 8 Pipeline main started { "message" => "46.119.114.245", "@version" => "1", "@timestamp" => "2017-01-12T07:15:02.731Z", "host" => "lnxolofon", "geoip" => { "ip" => "46.119.114.245", "country_code2" => "UA", "country_code3" => "UKR", "country_name" => "Ukraine", "continent_code" => "EU", "latitude" => 49.0, "longitude" => 32.0, "location" => [ [0] 32.0, [1] 49.0 ] } } Pipeline main has been shutdown stopping pipeline {:id=>"main"} ``` > And this is the logstash log message if you need it That message is completely unrelated. ---
**Author:** ![shubhrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhrant/32/20310_2.png) [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Post date:** [January 12, 2017, 7:23am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/9 "2017-01-12T07:23:48Z")
same output I got with the above command ![](https://us1.discourse-cdn.com/elastic/original/2X/9/99b8f33416cc211a1070b96b6a8f0ec47c4cb572.png) - Is it possible to create own file of internal ip addresses that will use at the time of GeoIP field ?? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 12, 2017, 8:07am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/10 "2017-01-12T08:07:49Z")
> same output I got with the above command Then there's something else in your configuration that removes the `geoip` field. Start by commenting out your elasticsearch output and use a simple `stdout { codec => rubydebug }` output. Does that make a difference? Clearly your Logstash is capable of looking up the IP address in question so it shouldn't be hard to narrow down the problem. > Is it possible to create own file of internal ip addresses that will use at the time of GeoIP field ?? The geoip filter supports custom GeoIP databases, so I suppose you should be able to create your own such database with your internal addresses. I don't know the details. ---
**Author:** ![shubhrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhrant/32/20310_2.png) [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Post date:** [January 12, 2017, 9:21am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/11 "2017-01-12T09:21:13Z")
I've changed my config to input { beats { port =\> 5044 } } filter { if [type] == "apache" { grok { match =\> { "message" =\> "%{COMBINEDAPACHELOG}" } } geoip { source =\> "clientip" } } } output { stdout { codec =\> rubydebug } } but still it is not showing ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 12, 2017, 10:12am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/12 "2017-01-12T10:12:46Z")
Continue with the simplification. What if you replace the beats input with a stdin input and pipe the same log to Logstash? ---
**Author:** ![shubhrant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubhrant/32/20310_2.png) [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Post date:** [January 12, 2017, 11:08am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/13 "2017-01-12T11:08:37Z")
same, output is not showing .... I'll do one thing that - i'll try to make my apache server on public ip, then maybe it will show... ok Magnus thanks for your valuable time ... 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 9, 2017, 11:09am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205/14 "2017-02-09T11:09:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.