# Geoip-info fail on auditbeat, filebeat and packetbeack

**URL:** <https://discuss.elastic.co/t/geoip-info-fail-on-auditbeat-filebeat-and-packetbeack/279497>\
**Category:** Beats\
**Tags:** filebeat, packetbeat, auditbeat\
**Created:** [July 23, 2021, 3:32pm UTC](https://discuss.elastic.co/t/geoip-info-fail-on-auditbeat-filebeat-and-packetbeack/279497 "2021-07-23T15:32:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![b0r1s](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b0r1s/32/85475_2.png) [@b0r1s](https://discuss.elastic.co/u/b0r1s)\
**Post date:** [July 23, 2021, 3:32pm UTC](https://discuss.elastic.co/t/geoip-info-fail-on-auditbeat-filebeat-and-packetbeack/279497/1 "2021-07-23T15:32:43Z")

</div>

Hello everyone o/

I followed [this](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-geoip.html) tutorial and after restarting the beats (it's the same steps for all beats) I can't receive any geoip-info fields.  
Do I need more configs on .yml files?

![geoip-info](https://us1.discourse-cdn.com/elastic/original/3X/8/f/8fe206011cd5a3077d21a0fba6fe3b23c1eed463.png)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 23, 2021, 5:39pm UTC](https://discuss.elastic.co/t/geoip-info-fail-on-auditbeat-filebeat-and-packetbeack/279497/2 "2021-07-23T17:39:01Z")

</div>

Hi @b0r1s

Can you post your 1 of your config files? You will need to add that pipeline to the elasticsearch output. Also remember the geoip only works for public IPs.

```auto
output.elasticsearch:
  hosts: ["localhost:9200"]
  pipeline: geoip-info

```

Are you sending the data directly from the Beats to Elasticsearch... is there anything in between?

The sample geoip-info pipeline will only work on the fields specified, if you IPs are in different fields then they would need to be referenced.

---

<div class="post-metadata">

**Author:** ![b0r1s](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b0r1s/32/85475_2.png) [@b0r1s](https://discuss.elastic.co/u/b0r1s)\
**Post date:** [July 23, 2021, 6:28pm UTC](https://discuss.elastic.co/t/geoip-info-fail-on-auditbeat-filebeat-and-packetbeack/279497/3 "2021-07-23T18:28:38Z")

</div>

Hi @stephenb o/

```auto
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["https://myelasticservers..."]
  pipeline: geoip-info
  # Protocol - either `http` (default) or `https`.
  protocol: "https"

```

I'm sending data directly from Beats to Elasticsearch.  
I just tested packetbeat on a Windows host where I accessed some external sites and geoip worked =]  
I think that before it was just capturing internal traffic, that's why it didn't appear...  
I apologize for my ignorance and thank you for your attention!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 20, 2021, 8:29pm UTC](https://discuss.elastic.co/t/geoip-info-fail-on-auditbeat-filebeat-and-packetbeack/279497/4 "2021-08-20T20:29:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.