# \[GEOIP\] Get target value as geoip from json input **URL:** \ **Category:** Logstash\ **Created:** [November 27, 2017, 10:27am UTC](https://discuss.elastic.co/t/geoip-get-target-value-as-geoip-from-json-input/109198 "2017-11-27T10:27:09Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![cs0sf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cs0sf/32/24713_2.png) [@cs0sf](https://discuss.elastic.co/u/cs0sf)\ **Post date:** [November 27, 2017, 10:27am UTC](https://discuss.elastic.co/t/geoip-get-target-value-as-geoip-from-json-input/109198/1 "2017-11-27T10:27:09Z")
Hi, I am trying to make use of geoip plugin so that the IP field could be mapped to geo location, etc My sample log looks like the following: {"key1":"blah", "network":[{"IP":"80.80.229.213"},{"IP":"80.80.229.216"}]} Sample logstash config: input { file { path =\> ["/home/ras/Code/corp/elkstackv6/logstash-6.0.0/test.log"] sincedb\_path =\> '/tmp/sincedb.path' start\_position =\> beginning codec =\> json { charset =\> "ISO-8859-1" } } } filter { geoip { source =\> "[network][IP]" target =\> "[network][GeoIP]" } } output { stdout { codec =\> rubydebug } } output: { "key1" =\> "blah", "path" =\> "/home/code/elkstackv6/logstash-6.0.0/test.log", "@timestamp" =\> 2017-11-27T10:23:37.848Z, "@version" =\> "1", "host" =\> "lab", "network" =\> [ [0] { "IP" =\> "80.80.80.9" }, [1] { "IP" =\> "80.80.60.60" } ], "tags" =\> [ [0] "\_geoip\_lookup\_failure" ] } ---
**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\ **Post date:** [November 27, 2017, 11:01am UTC](https://discuss.elastic.co/t/geoip-get-target-value-as-geoip-from-json-input/109198/2 "2017-11-27T11:01:46Z")
This is saying that "80.80.60.60" can't be found in the Maxmind GeoIP database. ---
**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\ **Post date:** [November 27, 2017, 11:24am UTC](https://discuss.elastic.co/t/geoip-get-target-value-as-geoip-from-json-input/109198/3 "2017-11-27T11:24:44Z")
FROM RIPE ```auto inetnum: 80.80.60.0 - 80.80.60.255 netname: PORTUS descr: H1Telekom d.d. descr: dial-up Osijek ``` ---
**Author:** ![cs0sf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cs0sf/32/24713_2.png) [@cs0sf](https://discuss.elastic.co/u/cs0sf)\ **Post date:** [November 27, 2017, 5:09pm UTC](https://discuss.elastic.co/t/geoip-get-target-value-as-geoip-from-json-input/109198/4 "2017-11-27T17:09:26Z")
I afraid but this is not the case. i changed the log format to look what is causing this and it seems to be the access to 'IP' which is present in list of dictionary if I change the above mentioned log sample with {"key1":"blah", "IP":"80.80.60.60", "network":[{"IP":"52.33.146.13"},{"IP":"52.40.59.173"}]} and conf with: geoip { source =\> "[IP]" target =\> "[GeoIP]" } which gives valid output { "key1" =\> "blah", "GeoIP" =\> { "timezone" =\> "Europe/Zagreb", "ip" =\> "80.80.60.60", "latitude" =\> 45.1667, "country\_name" =\> "Croatia", "country\_code2" =\> "HR", "continent\_code" =\> "EU", "country\_code3" =\> "HR", "location" =\> { "lon" =\> 15.5, "lat" =\> 45.1667 }, "longitude" =\> 15.5 }, "path" =\> "/home/code/elkstackv6/logstash-6.0.0/test.log", "@timestamp" =\> 2017-11-27T17:04:15.069Z, "IP" =\> "80.80.60.60", "@version" =\> "1", "host" =\> "xlabs", "network" =\> [ [0] { "IP" =\> "52.33.146.13" }, [1] { "IP" =\> "52.40.59.173" } ] } If there any way by which we can have geo info for IP type data which is present in list of dictionary ? ( I think we are unable to access the IP inside list of dictionary and hence getting "\_geoip\_lookup\_failure") ---
**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\ **Post date:** [November 27, 2017, 5:20pm UTC](https://discuss.elastic.co/t/geoip-get-target-value-as-geoip-from-json-input/109198/5 "2017-11-27T17:20:55Z")
Sorry, you are correct. The real problem though is that the value of the field `[network]` is an **Array**. **Q: Does it always have two entries only?** This means you need to need to use this nested field reference: `[network][0][IP]` to pluck the first entry which is a Hash or Map of `"IP" => "80.80.229.213"` `[network][1][IP]` to pluck the second entry which is a Hash or Map of `"IP" => "80.80.229.216"` You could consider using the `split` filter which will create two new events (cloned from the original) each one having a different IP field. If you decide to split then you will not need the `[network][N][IP]` field reference. ---
**Author:** ![cs0sf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cs0sf/32/24713_2.png) [@cs0sf](https://discuss.elastic.co/u/cs0sf)\ **Post date:** [November 27, 2017, 6:26pm UTC](https://discuss.elastic.co/t/geoip-get-target-value-as-geoip-from-json-input/109198/6 "2017-11-27T18:26:13Z")
Q: Does it always have two entries only? A: No, it can be of any length including 0 Yes, Split can be a good candidate to be used here but it will create cloned events which is somewhat i would keep distance from Array is a complex data structure here and i think there is no solution to the problem except changing the way log looks Thanks @guyboertje for finding time ---
**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\ **Post date:** [November 28, 2017, 7:28am UTC](https://discuss.elastic.co/t/geoip-get-target-value-as-geoip-from-json-input/109198/7 "2017-11-28T07:28:50Z")
You are welcome. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 26, 2017, 7:28am UTC](https://discuss.elastic.co/t/geoip-get-target-value-as-geoip-from-json-input/109198/8 "2017-12-26T07:28:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.