# Geoip is mapped as a string by default

**URL:** <https://discuss.elastic.co/t/geoip-is-mapped-as-a-string-by-default/205835>\
**Category:** Elasticsearch\
**Created:** [October 30, 2019, 11:30am UTC](https://discuss.elastic.co/t/geoip-is-mapped-as-a-string-by-default/205835 "2019-10-30T11:30:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![moscha](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@moscha](https://discuss.elastic.co/u/moscha)\
**Post date:** [October 30, 2019, 11:30am UTC](https://discuss.elastic.co/t/geoip-is-mapped-as-a-string-by-default/205835/1 "2019-10-30T11:30:04Z")

</div>

Hello all. I am fairly new to ELK and I am trying to troubleshoot a problem I am facing with geoip.  
I followed this guide to install everything: [https://www.elastic.co/guide/en/elastic-stack-get-started/7.4/get-started-elastic-stack.html](https://www.elastic.co/guide/en/elastic-stack-get-started/7.4/get-started-elastic-stack.html)  
Then after I understood a little bit better how things are working, I disabled metricbeat and installed filebeat: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html)

I am able to parse 2 different kinds of logs from Apache using grok.  
After that I tried to add the geoip fitler, however it is not working.  
I searched and I saw that(after following the guide for filebeat) I have default index pattern called "Filebeat-\*", the indices are created using the format "Filebeat-version-YYYY.MM.dd", and the geoip mapping is set to String.

here is my logstash configuration:

```
  input {
      beats {
        port => 5044
      }
    }

filter {
  if "WARN" in [message] { drop{ } }
  if " - - " in [message] {
 grok { match => { "message" => "%{IP:client} %{DATA:em} \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATHPARAM:request} %{DATA:http}\" %{NUMBER:response}" } }
 geoip { source => "client" }

}else {

 grok { match => { "message" => "%{IP:client} \[%{HTTPDATE:timestamp}\] %{WORD:method} %{URIPATHPARAM:request} %{DATA:http} %{NUMBER:response} %{NUMBER:duration}" } }
 geoip { source => "client" }
}

 if [system][process] {
    if [system][process][cmdline] {
      grok {
        match => {
          "[system][process][cmdline]" => "^%{PATH:[system][process][cmdline_path]}"
        }
        remove_field => "[system][process][cmdline]"
      }
    }
  }

}

output {
  elasticsearch {
    hosts => "localhost:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
  }
}

```

I tried deleting the default index pattern, deleting the latest index of Filebeat(ending in 10.30) but still I can not seem to be able to solve it.  
I am 100% sure that I have failed somewhere along the way, but can you provide me with some information, so future indices can have the correct geoip mapping?

Thank you very much

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2019, 11:30am UTC](https://discuss.elastic.co/t/geoip-is-mapped-as-a-string-by-default/205835/2 "2019-11-27T11:30:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.