# Geoip is not working for pfsense

**URL:** <https://discuss.elastic.co/t/geoip-is-not-working-for-pfsense/144731>\
**Category:** Logstash\
**Created:** [August 16, 2018, 2:45pm UTC](https://discuss.elastic.co/t/geoip-is-not-working-for-pfsense/144731 "2018-08-16T14:45:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![APASCHE](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@APASCHE](https://discuss.elastic.co/u/APASCHE)\
**Post date:** [August 16, 2018, 2:45pm UTC](https://discuss.elastic.co/t/geoip-is-not-working-for-pfsense/144731/1 "2018-08-16T14:45:12Z")

</div>

Hello guys,  
I am new to ELK and I have a single problem node for generating GEOIP information. Need help. Has anyone had the same problem?  
follows how the logstash configuration looks like I want change the template to logstash, because packetbeat There are 14 thousand lines and it can be wrong.  
{  
"packetbeat-6.3.2": {  
"order": 1,  
"index\_patterns": [  
"packetbeat-6.3.2-_"  
],  
"settings": {  
"index": {  
"mapping": {  
"total\_fields": {  
"limit": "10000"  
}  
},  
"refresh\_interval": "5s",  
"number\_of\_routing\_shards": "30",  
"number\_of\_shards": "3"  
}  
},  
"mappings": {  
"doc": {  
"\_meta": {  
"version": "6.3.2"  
},  
"date\_detection": false,  
"dynamic\_templates": [  
{  
"fields": {  
"mapping": {  
"type": "keyword"  
},  
"match\_mapping\_type": "string",  
"path\_match": "fields._"  
}  
},  
{  
"docker.container.labels": {  
"mapping": {  
"type": "keyword"  
},  
"match\_mapping\_type": "string",  
"path\_match": "docker.container.labels._"  
}  
},  
{  
"amqp.headers": {  
"mapping": {  
"type": "keyword"  
},  
"match\_mapping\_type": "string",  
"path\_match": "amqp.headers._"  
}  
},  
{  
"cassandra.response.supported": {  
"mapping": {  
"type": "keyword"  
},  
"match\_mapping\_type": "string",  
"path\_match": "cassandra.response.supported._"  
}  
},  
{  
"http.request.headers": {  
"mapping": {  
"type": "keyword"  
},  
"match\_mapping\_type": "string",  
"path\_match": "http.request.headers._"  
}  
},  
{  
"http.response.headers": {  
"mapping": {  
"type": "keyword"  
},  
"match\_mapping\_type": "string",  
"path\_match": "http.response.headers.\*"  
}  
},  
{  
"strings\_as\_keyword": {  
"mapping": {  
"ignore\_above": 1024,  
"type": "keyword"  
},  
"match\_mapping\_type": "string"  
}  
}  
],  
"properties": {  
"status": {  
"ignore\_above": 1024,  
"type": "keyword"  
},  
"resource": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"nfs": {  
"properties": {  
"version": {  
"type": "long"  
},  
"minor\_version": {  
"type": "long"  
},  
"tag": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"opcode": {  
"type": "keyword",  
"ignore\_above": 1024  
},  
"status": {  
"type": "keyword",  
"ignore\_above": 1024  
}

---

<div class="post-metadata">

**Author:** ![APASCHE](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@APASCHE](https://discuss.elastic.co/u/APASCHE)\
**Post date:** [August 17, 2018, 11:34am UTC](https://discuss.elastic.co/t/geoip-is-not-working-for-pfsense/144731/2 "2018-08-17T11:34:39Z")

</div>

This is my error log. Grok failed parse failed and GEOIP failed. How can I fix it?

tags:  
\_grokparsefailure, PFSense, firewall, \_dateparsefailure, \_geoip\_lookup\_failure  
@timestamp:  
August 17th 2018, 08:26:37.266  
syslog\_severity:  
notice  
host:  
10.10.0.151  
syslog\_facility:  
user-level  
type:  
syslog  
syslog\_facility\_code:  
1  
syslog\_severity\_code:  
5  
prog:  
filterlog  
message:  
9,,,1000000103,lagg0.8,match,block,in,4,0x0,,128,17671,0,none,17,udp,46,10.10.43.77,255.255.255.255,13382,13364,26  
@version:  
1  
evtid:  
134  
\_id:  
qNujR2UByLlvsGVhH8eC  
\_type:  
doc  
\_index:  
logstash-2018.08.17  
\_score:

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 14, 2018, 11:34am UTC](https://discuss.elastic.co/t/geoip-is-not-working-for-pfsense/144731/3 "2018-09-14T11:34:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.