# Geoip.ip field not translating to coordinates on Region Map

**URL:** <https://discuss.elastic.co/t/geoip-ip-field-not-translating-to-coordinates-on-region-map/201543>\
**Category:** Logstash\
**Tags:** maps\
**Created:** [September 29, 2019, 7:42pm UTC](https://discuss.elastic.co/t/geoip-ip-field-not-translating-to-coordinates-on-region-map/201543 "2019-09-29T19:42:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hackdefendr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hackdefendr/32/54683_2.png) [@hackdefendr](https://discuss.elastic.co/u/hackdefendr)\
**Post date:** [September 29, 2019, 7:42pm UTC](https://discuss.elastic.co/t/geoip-ip-field-not-translating-to-coordinates-on-region-map/201543/1 "2019-09-29T19:42:09Z")

</div>

Once upon a time I was able to create a Region map that showed circles for location hits based on the geoip.ip field. For some reason now only the geoip.countrycode2 field works.

Here is my logstash config:

```
input {
       # this is the actual live log file to monitor
       file {
              path => ["/home/cowrie/cowrie/var/log/cowrie/cowrie.json*"]
              codec => json
              type => "cowrie"
       }
       # this is to send old logs to for reprocessing
       tcp {
              port => 3333
              type => "cowrie"
       }
}

filter {
    if [type] == "cowrie" {

        #json {
        # source => eventid
        #}

        date {
            match => ["timestamp", "ISO8601"]
        }
                kv {
                        source => "message"
                        value_split => ":"
                        field_split => ","
                }
        if [src_ip] {

            mutate {
                add_field => { "src_host" => "%{src_ip}" }
            }

            dns {
                reverse => ["src_host"]

                nameserver => ["10.71.1.1", "1.1.1.1"]

                action => "replace"

                hit_cache_size => 4096
                hit_cache_ttl => 900
                failed_cache_size => 512
                failed_cache_ttl => 900
            }

                        geoip {
                                database => "/var/opt/logstash/vendor/geoip/GeoLite2-City.mmdb"
                        source => "src_ip"
                        target => "geoip"
                add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
                add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
                }

                        mutate {
                        convert => ["[geoip][coordinates]", "float" ]
                }

        }

    }
}

output {
    if [type] == "cowrie" {
        elasticsearch {
            hosts => ["localhost:9200"]
        }
        file {
            path => "/var/log/cowrie-logstash.log"
            codec => json
        }
        stdout {
            codec => rubydebug
        }
    }
}

```

Here is what I am doing...I am dumping json logs from a Cowrie honeypot into a log file where logstash picks them up. Using basic json parsing I get over 300 available fields, including all of the geoip fields. The region map used to work with the geoip.ip field I believe, but now it only works with geoip.country\_code 2 and the maps are all colored in by country.

Does anyone have any ideas where I should look to troubleshoot this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 27, 2019, 7:53pm UTC](https://discuss.elastic.co/t/geoip-ip-field-not-translating-to-coordinates-on-region-map/201543/2 "2019-10-27T19:53:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.