# GeoIP filter does not work with a subfield

**URL:** https://discuss.elastic.co/t/geoip-filter-does-not-work-with-a-subfield/306750
**Category:** Logstash
**Created:** [June 9, 2022, 1:44am UTC](https://discuss.elastic.co/t/geoip-filter-does-not-work-with-a-subfield/306750 "2022-06-09T01:44:31Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 9, 2022, 2:25am UTC](https://discuss.elastic.co/t/geoip-filter-does-not-work-with-a-subfield/306750/2 "2022-06-09T02:25:00Z")

</div>

> [@austin0918](#):
>
> ```auto
> if [client][ip] {
> geoip {
> source => "[client][ip]"
> target => "[client][ip][geo]"
> }
> }
> 
> ```

Read you logstash log. It will contain a message like this. I know it is not helpful (I think the wording is flat out wrong, because [foo] _is_ a string, so "not either a map or a string" should evaluate false, not true, but that's just me)

> Pipeline worker error, the pipeline will be stopped {:pipeline\_id=\>"main", :error=\>"Could not set field 'geo' on object '192.188.44.3' to value '{}'.This is probably due to trying to set a field like [foo][bar] = someValuewhen [foo] is not either a map or a string",

Setting `target => "[client][ip][geo]"` means [client][ip] has to be an object, but it is a string, so you cannot create another field within it. Change your configuration to use `target => "[client][geo]"` or anything else except its current value.

---

_[View the full topic](https://discuss.elastic.co/t/geoip-filter-does-not-work-with-a-subfield/306750)._