# Geoip is not generate .location

**URL:** <https://discuss.elastic.co/t/geoip-is-not-generate-location/90951>\
**Category:** Logstash\
**Created:** [June 27, 2017, 11:41am UTC](https://discuss.elastic.co/t/geoip-is-not-generate-location/90951 "2017-06-27T11:41:29Z")\
**Posts on this page:** 4\
**Page:** 2

<div class="post-metadata">

**Author:** ![legolas\_bilbao](https://avatars.discourse-cdn.com/v4/letter/l/3da27b/32.png) [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\
**Post date:** [June 28, 2017, 11:46am UTC](https://discuss.elastic.co/t/geoip-is-not-generate-location/90951/21 "2017-06-28T11:46:11Z")

</div>

Hi Christian

Changes I did:

pam-traffic.json

```
"properties" : {
         "@version": { "type": "string", "index": "not_analyzed" },
         "geoip" : {
           "type" : "object",
             "dynamic": true,
             "properties" : {
                "ip": { "type": "ip" }, "location" : { "type" : "geo_point" }, "latitude" : { "type" : "half_float" }, "longitude" : { "type" : "half_float" }
             }
         },
        "SourceGeo" : {
           "type" : "object",
             "dynamic": true,
             "properties" : {
               "location" : { "type" : "geo_point" }
             }
         },
         "DestinationGeo" : {
           "type" : "object",
             "dynamic": true,
             "properties" : {
               "location" : { "type" : "geo_point" }
             }
         }

```

curl -XPUT '[http://localhost:9200/\_template/pan-traffic](http://localhost:9200/_template/pan-traffic)' -d@/etc/logstash/pantraffic-template.json  
curl -XDELETE 'localhost:9200/pan-traffic?pretty'

Delete the pan-index in kibana and regenerate it and the result is

 ![](https://us1.discourse-cdn.com/elastic/original/3X/f/f/fff0c31f110b9b9ec9e1e6902a3ef3a81a497970.JPG)

---

<div class="post-metadata">

**Author:** ![legolas\_bilbao](https://avatars.discourse-cdn.com/v4/letter/l/3da27b/32.png) [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\
**Post date:** [July 3, 2017, 6:50am UTC](https://discuss.elastic.co/t/geoip-is-not-generate-location/90951/22 "2017-07-03T06:50:12Z")

</div>

any ideas why does not work properly?

kindly regards

---

<div class="post-metadata">

**Author:** ![legolas\_bilbao](https://avatars.discourse-cdn.com/v4/letter/l/3da27b/32.png) [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\
**Post date:** [July 4, 2017, 7:40am UTC](https://discuss.elastic.co/t/geoip-is-not-generate-location/90951/23 "2017-07-04T07:40:02Z")

</div>

Good morning,

I've reviewed the output of the logstash and location has lon and lat as array as you can see in the following trace:

```
"DestinationGeo":{  
  "timezone":"America/Los_Angeles",
  "ip":"216.58.206.142",
  "latitude":37.419200000000004,
  "continent_code":"NA",
  "city_name":"Mountain View",
  "country_name":"United States",
  "country_code2":"US",
  "dma_code":807,
  "country_code3":"US",
  "region_name":"California",
  "location":{  
     "lon":-122.0574,
     "lat":37.419200000000004
  },
  "postal_code":"94043",
  "region_code":"CA",
  "longitude":-122.0574

```

But in kibana doesnt appear the option related to DestionationGeo.location :S

the template loaded into elasticsearch is the following:

```
{
  "pan-traffic" : {
    "order" : 0,
    "version" : 2,
    "template" : "pan_traffic",
    "settings" : {
      "index" : {
        "refresh_interval" : "5s"
      }
    },
    "mappings" : {
      "_default_" : {
        "dynamic_templates" : [
          {
            "message_field" : {
              "mapping" : {
                "index" : "analyzed",
                "omit_norms" : true,
                "type" : "string"
              },
              "match_mapping_type" : "string",
              "match" : "message"
            }
          },
          {
            "string_fields" : {
              "mapping" : {
                "index" : "analyzed",
                "omit_norms" : true,
                "type" : "string",
                "fields" : {
                  "raw" : {
                    "ignore_above" : 256,
                    "index" : "not_analyzed",
                    "type" : "string"
                  }
                }
              },
              "match_mapping_type" : "string",
              "match" : "*"
            }
          }
        ],
        "_all" : {
          "enabled" : true
        },
        "properties" : {
          "SourceGeo" : {
            "dynamic" : true,
            "properties" : {
              "latitude" : {
                "type" : "half_float"
              },
              "location" : {
                "type" : "geo_point"
              },
              "longitude" : {
                "type" : "half_float"
              }
            }
          },
          "DestinationGeo" : {
            "dynamic" : true,
            "properties" : {
              "latitude" : {
                "type" : "half_float"
              },
              "location" : {
                "type" : "geo_point"
              },
              "longitude" : {
                "type" : "half_float"
              }
            }
          },
          "@version" : {
            "index" : "not_analyzed",
            "type" : "string"
          }
        }
      }
    },
    "aliases" : { }
  }
}

```

the logstash.conf is the following

```
if [SourceAddress] and [SourceAddress] !~ "(^127\.0\.0\.1)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)|(^169\.254\.)" {
      geoip {
           database => "/etc/logstash/GeoLite2.mmdb"
           source => "SourceAddress"
           target => "SourceGeo"
      }
      #Delete 0,0 in SourceGeo.location if equal to 0,0
      if ([SourceGeo.location] and [SourceGeo.location] =~ "0,0") {
        mutate {
          replace => ["SourceGeo.location", ""]
        }
      }
    }
   #Geolocate logs that have DestinationAddress and if that DestinationAddress is a non-RFC1918 address
  if [DestinationAddress] and [DestinationAddress] !~ "(^127\.0\.0\.1)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)|(^169\.254\.)" {
      geoip {
           database => "/etc/logstash/GeoLite2.mmdb"
           source => "DestinationAddress"
           target => "DestinationGeo"
      }
      #Delete 0,0 in DestinationGeo.location if equal to 0,0
      if ([DestinationGeo.location] and [DestinationGeo.location] =~ "0,0") {
        mutate {
          replace => ["DestinationAddress.location", ""]
        }
      }
    }

```

Any ideas why it's not generating the .location as geo\_point as DestinationGeo and SourceGeo

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 1, 2017, 7:40am UTC](https://discuss.elastic.co/t/geoip-is-not-generate-location/90951/24 "2017-08-01T07:40:04Z")

</div>

Closed on August 1, 2017, 7:40am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/geoip-is-not-generate-location/90951.md?page=1)