# Geoip.ip and private ip file

**URL:** <https://discuss.elastic.co/t/geoip-ip-and-private-ip-file/72301>\
**Category:** Logstash\
**Created:** [January 20, 2017, 2:22pm UTC](https://discuss.elastic.co/t/geoip-ip-and-private-ip-file/72301 "2017-01-20T14:22:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Grenouille06](https://avatars.discourse-cdn.com/v4/letter/g/48db29/32.png) [@Grenouille06](https://discuss.elastic.co/u/Grenouille06)\
**Post date:** [January 20, 2017, 2:22pm UTC](https://discuss.elastic.co/t/geoip-ip-and-private-ip-file/72301/1 "2017-01-20T14:22:46Z")

</div>

Hi, I want to try geoip functionnalities.

I import with ELK logs from many active directory controllers. I want to match IP from that logs with a personal file.  
For example 10.12.x.x =\> research floor 1 or 10.15.x.x -\> labs floor 6

I've found that I must use a filter in my logstash.conf

filter {  
mutate {  
remove\_field =\> ["@version", "@timestamp"]  
}  
geoip {  
source =\> "event\_data.IpAddress" \<--- the field containing the IP string  
}  
}  
So where to put my source file and how to build it (csv or something else ????)

A great thanks for your help

Fayce

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 21, 2017, 8:31am UTC](https://discuss.elastic.co/t/geoip-ip-and-private-ip-file/72301/2 "2017-01-21T08:31:42Z")

</div>

Have a look at [Creating geoip data for internal networks](https://discuss.elastic.co/t/creating-geoip-data-for-internal-networks/729/10)

---

<div class="post-metadata">

**Author:** ![Grenouille06](https://avatars.discourse-cdn.com/v4/letter/g/48db29/32.png) [@Grenouille06](https://discuss.elastic.co/u/Grenouille06)\
**Post date:** [January 26, 2017, 1:24pm UTC](https://discuss.elastic.co/t/geoip-ip-and-private-ip-file/72301/3 "2017-01-26T13:24:00Z")

</div>

Thanks for your reply.

In my case, I want to build a custom.dat database  
Here is a simple of my file csv file

startIP,endIP,country,region,city,postalCode,latitude,longitude,metroCode,areaCode  
168561408,168561663,FR,,Nice,06200,43.667509,7.213238,"455 Promenade des Anglais","Communica 1"  
171105024,171105279,FR,,Nice,06200,43.667509,7.213238,"455 Promenade des Anglais","Communica 2"

When I try to build the dat file with the command from /usr/lib/geoip :

./geoip-generator -v -o custom\_geoip.dat /etc/logstash/geoip/GeoLiteCity-NCA.csv

I get that error :

./geoip-generator: Reading CSV and building the trie  
./geoip-generator:/etc/logstash/geoip/GeoLiteCity-NCA.csv:1: Wrong number of fields

I don't know which field is missing.

Thanks for help friends

---

<div class="post-metadata">

**Author:** ![Grenouille06](https://avatars.discourse-cdn.com/v4/letter/g/48db29/32.png) [@Grenouille06](https://discuss.elastic.co/u/Grenouille06)\
**Post date:** [January 26, 2017, 1:47pm UTC](https://discuss.elastic.co/t/geoip-ip-and-private-ip-file/72301/4 "2017-01-26T13:47:06Z")

</div>

Update, I hade the -l option to specify the location of my csv file.

./geoip-generator -v -o custom\_geoip.dat -l /etc/logstash/geoip/GeoLiteCity-NCA.csv

It seems to work, it takes a very long time but nothing happens. When I press Enter I have tue Wrong number of fields error message, again.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 23, 2017, 1:47pm UTC](https://discuss.elastic.co/t/geoip-ip-and-private-ip-file/72301/5 "2017-02-23T13:47:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.