# Geoip Field mapping

**URL:** <https://discuss.elastic.co/t/geoip-field-mapping/121904>\
**Category:** Logstash\
**Created:** [February 28, 2018, 5:09pm UTC](https://discuss.elastic.co/t/geoip-field-mapping/121904 "2018-02-28T17:09:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Catalin\_Liviu\_Vrince](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/catalin_liviu_vrince/32/28258_2.png) [@Catalin\_Liviu\_Vrince](https://discuss.elastic.co/u/Catalin_Liviu_Vrince)\
**Post date:** [February 28, 2018, 5:09pm UTC](https://discuss.elastic.co/t/geoip-field-mapping/121904/1 "2018-02-28T17:09:13Z")

</div>

Hi guys,

I have one issue parsing the nested geoip filed on Logstash 5.6.7. I'm not able to find the right path for this. Please can you help me with that?

Input:

> 10.57.49.85 - catalin.vrinceanu [28/Feb/2018:16:44:58 +0000] "GET /ui/favicons/favicon-16x16.png HTTP/1.1" 304 0 "[https://catalinvr.com/app/kibana](https://catalinvr.com/app/kibana)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_13\_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36"

logstash filter:

> filter {  
> if [SourceModuleName] == "nginx\_access\_log" {  
> grok {  
> 'match' =\> ["message", "%{IPORHOST:[access][remote\_ip]} %{USER:[access][ident]} %{USER:[access][user\_name]} [%{HTTPDATE:nginxtimestamp}] "((%{WORD:[access][method]} %{URIPATHPARAM:[access][request]} HTTP/%{NUMBER:[access][http\_version]})|-)" %{NUMBER:[access][response\_code]} (?:%{NUMBER:[access][body\_sent][bytes]}|-) (?:"(?:%{URI:[access][referrer]}|-)"|%{QS:[access][referrer]}) %{QS:[access][agent]}" ]  
> }  
> geoip {  
> source =\> "[access][remote\_ip]"  
> target =\> "[access][geoip]"  
> }  
> date {  
> match =\> ["nginxtimestamp", "dd/MMM/YYYY:HH:mm:ss Z"]  
> locale =\> en  
> }  
> useragent {  
> source =\> "[access][agent]"  
> target =\> "[access][user\_agent]"  
> }  
> }  
> }

On the index template, the geoip field is mapped correctly:

> { "mappings": {  
> "_default_": {  
> "\_meta": {  
> "version": "5.6.8"  
> },  
> "date\_detection": false,  
> "dynamic\_templates": [  
> {  
> "strings\_as\_keyword": {  
> "mapping": {  
> "ignore\_above": 1024,  
> "type": "keyword"  
> },  
> "match\_mapping\_type": "string"  
> }  
> }  
> ],  
> "properties": {  
> "access": {  
> "properties": {  
> "agent": {  
> "norms": false,  
> "type": "text"  
> },  
> "body\_sent": {  
> "properties": {  
> "bytes": {  
> "type": "long"  
> }  
> }  
> },  
> "geoip": {  
> "properties": {  
> "city\_name": {  
> "ignore\_above": 1024,  
> "type": "keyword"  
> },  
> "continent\_name": {  
> "ignore\_above": 1024,  
> "type": "keyword"  
> },  
> "country\_iso\_code": {  
> "ignore\_above": 1024,  
> "type": "keyword"  
> },  
> "location": {  
> "type": "geo\_point"  
> },  
> "region\_name": {  
> "ignore\_above": 1024,  
> "type": "keyword"  
> }  
> }  
> }  
> }  
> },  
> "@timestamp": {  
> "type": "date"  
> },  
> "message": {  
> "norms": false,  
> "type": "text"  
> },  
> "tags": {  
> "ignore\_above": 1024,  
> "type": "keyword"  
> },  
> "type": {  
> "ignore\_above": 1024,  
> "type": "keyword"  
> }  
> }  
> }  
> },  
> "order": 0,  
> "settings": {  
> "index.mapping.total\_fields.limit": 10000,  
> "index.refresh\_interval": "5s"  
> },  
> "template": "nginx-\*"  
> }

Thank you,  
Catalin

---

<div class="post-metadata">

**Author:** ![Catalin\_Liviu\_Vrince](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/catalin_liviu_vrince/32/28258_2.png) [@Catalin\_Liviu\_Vrince](https://discuss.elastic.co/u/Catalin_Liviu_Vrince)\
**Post date:** [February 28, 2018, 6:07pm UTC](https://discuss.elastic.co/t/geoip-field-mapping/121904/2 "2018-02-28T18:07:17Z")

</div>

Please ignore this request.  
This was caused because I the Ip was private.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2018, 6:07pm UTC](https://discuss.elastic.co/t/geoip-field-mapping/121904/3 "2018-03-28T18:07:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.