# GeoIP Filter in ECS-Compatiblity mode requires a \`target\` when \`source\` is not an \`ip\` sub-field, eg. \[client\]\[ip\] **URL:** \ **Category:** Logstash\ **Created:** [January 3, 2024, 11:24pm UTC](https://discuss.elastic.co/t/geoip-filter-in-ecs-compatiblity-mode-requires-a-target-when-source-is-not-an-ip-sub-field-eg-client-ip/350343 "2024-01-03T23:24:04Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![e-ferrari](https://avatars.discourse-cdn.com/v4/letter/e/898d66/32.png) [@e-ferrari](https://discuss.elastic.co/u/e-ferrari)\ **Post date:** [January 3, 2024, 11:24pm UTC](https://discuss.elastic.co/t/geoip-filter-in-ecs-compatiblity-mode-requires-a-target-when-source-is-not-an-ip-sub-field-eg-client-ip/350343/1 "2024-01-03T23:24:04Z")
Hi, i'm trying to setup [Parsing Logs with Logstash | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html). But i get errors: ```auto [2024-01-04T00:06:45,246][ERROR][logstash.javapipeline][main] Pipeline error {:pipeline_id=>"main", :exception=># ``` My pipeline looks like this: ```input beats { ssl => "false" port => "5044" } } filter { grok { match => { "message" => "%{COMBINEDAPACHELOG}"} } geoip { source => "clientip" } } output { stdout { codec => rubydebug } } ``` When i comment out the geoip filter i get this: ```auto { "input" => { "type" => "log" }, "ecs" => { "version" => "8.0.0" }, "@version" => "1", "log" => { "offset" => 34227, "file" => { "path" => "/root/logstash-tutorial.log" } }, "host" => { "name" => "suricata" }, "agent" => { "ephemeral_id" => "601bd8bf-5443-410f-8712-56e85a58295e", "name" => "suricata", "version" => "8.11.3", "id" => "d64a8bc7-2c9f-4ac7-a499-7daa78227552", "type" => "filebeat" }, "source" => { "address" => "86.1.76.62" }, "timestamp" => "04/Jan/2015:05:30:37 +0000", "@timestamp" => 2024-01-03T19:51:34.436Z, "http" => { "response" => { "status_code" => 200, "body" => { "bytes" => 4877 } }, "version" => "1.1", "request" => { "referrer" => "http://www.semicomplete.com/projects/xdotool/", "method" => "GET" } }, "url" => { "original" => "/style2.css" }, "tags" => [ [0] "beats_input_codec_plain_applied" ], "user_agent" => { "original" => "Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205 Firefox/24.0 Iceweasel/24.3.0" }, "message" => "86.1.76.62 - - [04/Jan/2015:05:30:37 +0000] \"GET /style2.css HTTP/1.1\" 200 4877 \"http://www.semicomplete.com/projects/xdotool/\" \"Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205 Firefox/24.0 Iceweasel/24.3.0\"", "event" => { "original" => "86.1.76.62 - - [04/Jan/2015:05:30:37 +0000] \"GET /style2.css HTTP/1.1\" 200 4877 \"http://www.semicomplete.com/projects/xdotool/\" \"Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205 Firefox/24.0 Iceweasel/24.3.0\"" } } ``` I don't see "geoip". Is this the problem? I played around with the filter and tried: ```auto filter { grok { match => { "message" => "%{COMBINEDAPACHELOG}"} } geoip { source => "[source][address]" } } ``` but didn't suceed. Bernd ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 4, 2024, 3:16am UTC](https://discuss.elastic.co/t/geoip-filter-in-ecs-compatiblity-mode-requires-a-target-when-source-is-not-an-ip-sub-field-eg-client-ip/350343/2 "2024-01-04T03:16:40Z")
If your geoip filter has source that looks like [someField][ip], then it assumes that it is OK to add all the geoip fields under [someField]. Otherwise it needs you to tell it where to add those fields. You will also need an index template if you want to end up with a geo\_point in an ES index. If ECS is disabled then the target will be [geoip], which limits you to one geoip filter, which is not good, since a lot of people are dealing with logs that have variable sources and destinations. ---
**Author:** ![e-ferrari](https://avatars.discourse-cdn.com/v4/letter/e/898d66/32.png) [@e-ferrari](https://discuss.elastic.co/u/e-ferrari)\ **Post date:** [January 9, 2024, 3:44pm UTC](https://discuss.elastic.co/t/geoip-filter-in-ecs-compatiblity-mode-requires-a-target-when-source-is-not-an-ip-sub-field-eg-client-ip/350343/3 "2024-01-09T15:44:26Z")
Hi, this is now my pipeline: ```filter grok { match => { "message" => "%{COMBINEDAPACHELOG}"} } geoip { source => "[source][address]" target => "source" } } ``` I get the following output: ```auto "address" => "86.1.76.62", "geo" => { "country_iso_code" => "GB", "timezone" => "Europe/London", "country_name" => "United Kingdom", "city_name" => "Burnley", "region_name" => "Lancashire", "postal_code" => "BB10", "region_iso_code" => "GB-LAN", "location" => { "lon" => -2.2372, "lat" => 53.8265 }, ``` For me that looks fine. What do you mean by "index template" ? Thanks. Bernd ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 9, 2024, 5:19pm UTC](https://discuss.elastic.co/t/geoip-filter-in-ecs-compatiblity-mode-requires-a-target-when-source-is-not-an-ip-sub-field-eg-client-ip/350343/4 "2024-01-09T17:19:26Z")
> [@e-ferrari](#): > > What do you mean by "index template" ? They are [a way to tell](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-templates.html) elasticsearch how to interpret the data that you write to it. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 6, 2024, 5:20pm UTC](https://discuss.elastic.co/t/geoip-filter-in-ecs-compatiblity-mode-requires-a-target-when-source-is-not-an-ip-sub-field-eg-client-ip/350343/5 "2024-02-06T17:20:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.