# Geoip help **URL:** \ **Category:** Logstash\ **Created:** [May 19, 2016, 4:54pm UTC](https://discuss.elastic.co/t/geoip-help/50476 "2016-05-19T16:54:10Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![anoopmk007](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@anoopmk007](https://discuss.elastic.co/u/anoopmk007)\ **Post date:** [May 19, 2016, 4:54pm UTC](https://discuss.elastic.co/t/geoip-help/50476/1 "2016-05-19T16:54:10Z")
Hello , I am trying to implement ELK for my customized logs. Almost done with my limited knowledge. Now logs are successfully parsing , storing in elasticsearch and showing in kibana. But like to include geo location (tilemap) in kibana. Could you please suggest best options for doing this? **Logs format:** [Key]value, [Key2]value2, [key3]value3 [Key]value, [Key2]value2, [key3]value3 **logstash configuration:-** input { file{ path =\> "\*.log" start\_position =\> "beginning" } } filter { kv { source =\> "message" value\_split =\> "]" field\_split =\> "," trimkey =\> "[" } output { elasticsearch { hosts =\> ["127.0.0.1:9200"] } stdout { codec =\> rubydebug } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 20, 2016, 5:49am UTC](https://discuss.elastic.co/t/geoip-help/50476/2 "2016-05-20T05:49:08Z")
Please show an example message so we can see what data is at our disposal. ---
**Author:** ![anoopmk007](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@anoopmk007](https://discuss.elastic.co/u/anoopmk007)\ **Post date:** [May 20, 2016, 10:11pm UTC](https://discuss.elastic.co/t/geoip-help/50476/3 "2016-05-20T22:11:13Z")
Thanks you Magnus for help. **Sample logs:-** [HOST]THOST, [LOCATION]001, [TIME\_STAMP]2016-05-18 08:52:37, [REG]4001, [OPTION]1754, [LAYER]GSDIM, [TYPE]REQ, [METHOD]SESSION, [ACTION]START [HOST]THOST, [LOCATION]001, [TIME\_STAMP]2016-05-18 08:52:38, [REG]4001, [OPTION]175, [LAYER]GSDIM, [TYPE]REP, [TIME]1, [METHOD]SESSION, [ACTION]START, [RESPONSE]Session Started [HOST]THOST, [LOCATION]010, [TIME\_STAMP]2016-05-18 08:52:45, [REG]4002, [OPTION]1756, [LAYER]GSDIM, [TYPE]REQ, [METHOD]LINE\_ITEM, [ACTION]ADD [HOST]THOST, [LOCATION]010, [TIME\_STAMP]2016-05-18 08:52:46, [REG]4002, [OPTION]1754, [LAYER]GSDIM, [TYPE]REP, [TIME]1, [METHOD]LINE\_ITEM, [ACTION]ADD, [RESPONSE]Operation SUCCESSFUL [HOST]THOST, [LOCATION]010, [TIME\_STAMP]2016-05-18 08:53:24, [REG]4002, [OPTION]1756, [LAYER]GSDIM, [TYPE]REQ,[METHOD]DEVICE, [ACTION]CUST\_QUESTION ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 21, 2016, 3:58pm UTC](https://discuss.elastic.co/t/geoip-help/50476/4 "2016-05-21T15:58:55Z")
And how would you extract geographical data from events like these? The only geo-related field I can find is the location field but that's just a single integer. ---
**Author:** ![anoopmk007](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@anoopmk007](https://discuss.elastic.co/u/anoopmk007)\ **Post date:** [May 23, 2016, 3:14am UTC](https://discuss.elastic.co/t/geoip-help/50476/5 "2016-05-23T03:14:13Z")
Hi Magnus, I am looking for an option to to get geo details in my log. Currently log does not have any geo location (ip, longitude and latitude etc ..) . Could you please suggest best practice her? Will something application can include in my log file ? or Logstash can append here? Thank your for prompt response.... ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 23, 2016, 5:36am UTC](https://discuss.elastic.co/t/geoip-help/50476/6 "2016-05-23T05:36:24Z")
Well, whatever thing that knows anything about the geographical location obviously needs to supply that information in the log. I have no idea what's producing your log and whether there even is a relevant geographical context so I can't make specific suggestions. Once you have _some_ kind of useful data we can talk about how to make use of it in Logstash. ---
**Author:** ![anoopmk007](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@anoopmk007](https://discuss.elastic.co/u/anoopmk007)\ **Post date:** [June 13, 2016, 10:32am UTC](https://discuss.elastic.co/t/geoip-help/50476/7 "2016-06-13T10:32:29Z")
Hi Magnus, Just tried to add latitude and longitude in logs for logstash. **In logstash configuration:-** **included under filter:-** mutate { add\_field =\>["[geoip][location]","%{[latitude]}"] add\_field =\>["[geoip][location]","%{[longitude]}"] } mutate { convert =\>["[geoip][location]","float"] } **Log file:-** [LAYER]GSDIM, [TYPE]REQ, [METHOD]SESSION, [ACTION]START, [latitude]47.60621,[longitude]-122.33207 [LAYER]GSDIM, [TYPE]REP, [TIME]1, [METHOD]SESSION, [ACTION]START, [RESPONSE]Session Started,[latitude]47.60621,[longitude]-122.33207 But still getting exception in elastic search Caused by: java.lang.IllegalArgumentException: illegal latitude value [-122.33207] for geoip.location at org.elasticsearch.index.mapper.geo.GeoPointFieldMapper.parse(GeoPointFieldMapper.java:123) at org.elasticsearch.index.mapper.geo.BaseGeoPointFieldMapper.parse(BaseGeoPointFieldMapper.java:469) at org.elasticsearch.index.mapper.DocumentParser.parseObjectOrField(DocumentParser.java:309) at org.elasticsearch.index.mapper.DocumentParser.parseArray(DocumentParser.java:371) at org.elasticsearch.index.mapper.DocumentParser.parseObject(DocumentParser.java:254) at org.elasticsearch.index.mapper.DocumentParser.parseObjectOrField(DocumentParser.java:306) at org.elasticsearch.index.mapper.DocumentParser.parseObject(DocumentParser.java:326) at org.elasticsearch.index.mapper.DocumentParser.parseObject(DocumentParser.java:252) at org.elasticsearch.index.mapper.DocumentParser.parseDocument(DocumentParser.java:122) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 13, 2016, 10:36am UTC](https://discuss.elastic.co/t/geoip-help/50476/8 "2016-06-13T10:36:33Z")
You've probably mixed up the order of latitude and longitude. The former are always in the range [-90, 90] while the latter are in the [-180, 180] range. ---
**Author:** ![anoopmk007](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@anoopmk007](https://discuss.elastic.co/u/anoopmk007)\ **Post date:** [June 16, 2016, 6:53am UTC](https://discuss.elastic.co/t/geoip-help/50476/9 "2016-06-16T06:53:16Z")
Thank you , really helped. I have switched latt and long from - [http://mondeca.com/index.php/en/any-place-en](http://mondeca.com/index.php/en/any-place-en) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:52am UTC](https://discuss.elastic.co/t/geoip-help/50476/10 "2017-07-06T04:52:33Z")