# GeoIP filter does not work with a subfield
**URL:** https://discuss.elastic.co/t/geoip-filter-does-not-work-with-a-subfield/306750
**Category:** Logstash
**Created:** [June 9, 2022, 1:44am UTC](https://discuss.elastic.co/t/geoip-filter-does-not-work-with-a-subfield/306750 "2022-06-09T01:44:31Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@austin0918](https://discuss.elastic.co/u/austin0918)
#### Post date: [June 9, 2022, 1:44am UTC](https://discuss.elastic.co/t/geoip-filter-does-not-work-with-a-subfield/306750/1 "2022-06-09T01:44:31Z")
I have a field client.ip that needs to get geo info. I tried below GeoIP filter but it didn't work. Looks like GeoIP does not work with a subfield. Please advise.
```auto
filter {
if [client][ip] {
geoip {
source => "[client][ip]"
target => "[client][ip][geo]"
}
}
}
```
I tried to add a new top field as below and received the expected results. Is there a way to work directly with the subfield [client][IP]?
```auto
filter {
if [client][ip] {
mutate {add_field => {"client_ip" => "%{[client][ip]}"}}
geoip {
source => "client_ip"
target => "client_geo"
}
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 9, 2022, 2:25am UTC](https://discuss.elastic.co/t/geoip-filter-does-not-work-with-a-subfield/306750/2 "2022-06-09T02:25:00Z")
> [@austin0918](#):
>
> ```auto
> if [client][ip] {
> geoip {
> source => "[client][ip]"
> target => "[client][ip][geo]"
> }
> }
>
> ```
Read you logstash log. It will contain a message like this. I know it is not helpful (I think the wording is flat out wrong, because [foo] _is_ a string, so "not either a map or a string" should evaluate false, not true, but that's just me)
> Pipeline worker error, the pipeline will be stopped {:pipeline\_id=\>"main", :error=\>"Could not set field 'geo' on object '192.188.44.3' to value '{}'.This is probably due to trying to set a field like [foo][bar] = someValuewhen [foo] is not either a map or a string",
Setting `target => "[client][ip][geo]"` means [client][ip] has to be an object, but it is a string, so you cannot create another field within it. Change your configuration to use `target => "[client][geo]"` or anything else except its current value.
---
### Author:  [@austin0918](https://discuss.elastic.co/u/austin0918)
#### Post date: [June 9, 2022, 3:20am UTC](https://discuss.elastic.co/t/geoip-filter-does-not-work-with-a-subfield/306750/3 "2022-06-09T03:20:16Z")
I fixed it following your guide. Thank you for your detailed clarification.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 7, 2022, 3:21am UTC](https://discuss.elastic.co/t/geoip-filter-does-not-work-with-a-subfield/306750/4 "2022-07-07T03:21:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.