# GeoIP lat,lon fields are numbers instead of float

**URL:** <https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132>\
**Category:** Logstash\
**Created:** [November 26, 2018, 8:19am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132 "2018-11-26T08:19:09Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![prakas](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@prakas](https://discuss.elastic.co/u/prakas)\
**Post date:** [November 26, 2018, 8:19am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/1 "2018-11-26T08:19:09Z")

</div>

Hello Team,

I see that the geoip.latitude, geoip.longitude are numbers and does not take decimal values, so a wrong position is plotted on the Tile Map.  
For example an ip of 14.143.35.10 results in lat:20, lon:77 whereas the actual values should have been lat:12.9833, lon:77.5833.  
I am not sure what is the mistake.  
My filter config:  
geoip {  
source =\> "clientip"  
}

GeoIP Index Mapping:  
"geoip": {  
"properties": {  
"city\_name": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"continent\_code": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"coordinates": {  
"type": "float"  
},  
"country\_code2": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"country\_code3": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"country\_name": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"ip": {  
"type": "ip"  
},  
"latitude": {  
"type": "float"  
},  
"location": {  
"type": "geo\_point"  
},  
"longitude": {  
"type": "float"  
},  
"postal\_code": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"region\_code": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"region\_name": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"timezone": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
}  
}  
},

Please help resolve this.

Many Thanks.

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 26, 2018, 8:40am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/2 "2018-11-26T08:40:12Z")

</div>

Is this your full filter config?

---

<div class="post-metadata">

**Author:** ![prakas](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@prakas](https://discuss.elastic.co/u/prakas)\
**Post date:** [November 26, 2018, 8:51am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/3 "2018-11-26T08:51:38Z")

</div>

Please find the full filter Config below:  
filter {  
grok {  
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:device} %{DATA:module}(?:[%{POSINT:pid}])?: %{GREEDYDATA:message}" }  
overwrite =\> ["message"]  
}  
grok {  
match =\> { "message" =\> [  
"[%{LOGLEVEL:loglevel}%{SPACE}] %{GREEDYDATA:syslog\_message}",  
"level=%{WORD:loglevel} %{GREEDYDATA:syslog\_message}",  
"%{IP:clientip}",  
"%{GREEDYDATA:syslog\_message}"  
]}  
}  
geoip {  
source =\> "clientip"  
}  
}

Thanks

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 26, 2018, 8:55am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/4 "2018-11-26T08:55:41Z")

</div>

Can you show me the raw output you are getting for all geoip fields please?

---

<div class="post-metadata">

**Author:** ![prakas](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@prakas](https://discuss.elastic.co/u/prakas)\
**Post date:** [November 26, 2018, 9:03am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/5 "2018-11-26T09:03:07Z")

</div>

> [@Eniqmatic](#):
>
> t you are getting for all geoip fields

JSON document is as follows:  
"\_source": {  
"module": "PublicIP",  
"clientip": "14.143.35.10",  
"geoip": {  
"ip": "14.143.35.10",  
"location": {  
"lat": 20,  
"lon": 77  
},  
"timezone": "Asia/Kolkata",  
"latitude": 20,  
"longitude": 77,  
"country\_code2": "IN",  
"continent\_code": "AS",  
"country\_code3": "IN",  
"country\_name": "India"  
},  
"timestamp": "Nov 16 11:30:21",  
"message": "14.143.35.10",  
"host": "14.143.35.10",  
"@version": "1",  
"@timestamp": "2018-11-16T11:30:23.638Z",  
"device": "a8248fa5-28f0-4daf-9137-078f5ee9dc55"  
},

Hope i have provided you the needed details.

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 26, 2018, 9:09am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/6 "2018-11-26T09:09:00Z")

</div>

I think your Longitude and Latitude fields should be set to "half\_float" not "float" - try changing these in the template to see if that resolves.

---

<div class="post-metadata">

**Author:** ![prakas](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@prakas](https://discuss.elastic.co/u/prakas)\
**Post date:** [November 26, 2018, 10:00am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/7 "2018-11-26T10:00:19Z")

</div>

@Eniqmatic, changing lat,lon to half\_float does not solve the issue.  
Anything else to try? Any help would be appreciated.  
Please see template for GeoIP below:  
"geoip": {  
"properties": {  
"continent\_code": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"coordinates": {  
"type": "float"  
},  
"country\_code2": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"country\_code3": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"country\_name": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"ip": {  
"type": "ip"  
},  
"latitude": {  
"type": "half\_float"  
},  
"location": {  
"type": "geo\_point"  
},  
"longitude": {  
"type": "half\_float"  
},  
"timezone": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
}  
}  
},

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 26, 2018, 10:06am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/8 "2018-11-26T10:06:06Z")

</div>

Can you post the raw value now?

---

<div class="post-metadata">

**Author:** ![prakas](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@prakas](https://discuss.elastic.co/u/prakas)\
**Post date:** [November 26, 2018, 10:23am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/9 "2018-11-26T10:23:54Z")

</div>

Its almost the same as earlier, please find below:  
"geoip": {  
"latitude": 20,  
"country\_code3": "IN",  
"continent\_code": "AS",  
"timezone": "Asia/Kolkata",  
"location": {  
"lon": 77,  
"lat": 20  
},  
"country\_code2": "IN",  
"longitude": 77,  
"coordinates": [  
77,  
20  
],  
"country\_name": "India",  
"ip": "14.143.35.10"  
},

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 26, 2018, 10:28am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/10 "2018-11-26T10:28:39Z")

</div>

What is your index name please? Can you do a GET using the development console on the index and post the mappings?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 26, 2018, 10:33am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/11 "2018-11-26T10:33:24Z")

</div>

I ran the following and that is the value that seems to be the value that comes from the default geoip database:

```auto
input {
  generator {
    lines => ['14.143.35.10']
    count => 1
  } 
} 

filter {
  geoip {
    source => "message"
  }
}

output {
  stdout { codec => rubydebug }
}

```

and this results in:

```auto
{
  "@timestamp" => 2018-11-26T10:28:07.996Z,
  "message" => "14.143.35.10",
  "geoip" => {
    "ip" => "14.143.35.10",
    "longitude" => 77.0,
    "country_code2" => "IN",
    "timezone" => "Asia/Kolkata",
    "latitude" => 20.0,
    "continent_code" => "AS",
    "country_code3" => "IN",
    "country_name" => "India",
    "location" => {
      "lat" => 20.0,
      "lon" => 77.0
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![prakas](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@prakas](https://discuss.elastic.co/u/prakas)\
**Post date:** [November 26, 2018, 10:52am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/12 "2018-11-26T10:52:09Z")

</div>

> [@Eniqmatic](#):
>
> ur index name please? Can you do a GET using the development console on the index and post the mappings?

But the actual value for 14.143.35.10 should have been lat:12.9833, lon:77.5833 ([https://ipinfo.io/](https://ipinfo.io/)).  
When i checked the GeoLite2-City-Blocks-IPv4.csv, i dont find an entry for 14.143.35.10. So how does that work? Does it apply some rules based on available IPs and come up with some value?  
Is there a way to change it?

---

<div class="post-metadata">

**Author:** ![prakas](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@prakas](https://discuss.elastic.co/u/prakas)\
**Post date:** [November 26, 2018, 10:53am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/13 "2018-11-26T10:53:10Z")

</div>

But the actual value for 14.143.35.10 should have been lat:12.9833, lon:77.5833 ([https://ipinfo.io/](https://ipinfo.io/)).  
When i checked the GeoLite2-City-Blocks-IPv4.csv, i dont find an entry for 14.143.35.10. So how does that work? Does it apply some rules based on available IPs and come up with some value?  
Is there a way to change it?

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 26, 2018, 10:56am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/14 "2018-11-26T10:56:13Z")

</div>

Can you do a get on the index as above?

---

<div class="post-metadata">

**Author:** ![prakas](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@prakas](https://discuss.elastic.co/u/prakas)\
**Post date:** [November 26, 2018, 11:11am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/15 "2018-11-26T11:11:31Z")

</div>

Here is the index mapping output on dev console:  
{  
"logstash-2018.11.26": {  
"mappings": {  
"doc": {  
"properties": {  
"@timestamp": {  
"type": "date"  
},  
"@version": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"clientip": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"device": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"geoip": {  
"properties": {  
"continent\_code": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"coordinates": {  
"type": "float"  
},  
"country\_code2": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"country\_code3": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"country\_name": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"ip": {  
"type": "ip"  
},  
"latitude": {  
"type": "half\_float"  
},  
"location": {  
"type": "geo\_point"  
},  
"longitude": {  
"type": "half\_float"  
},  
"timezone": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
}  
}  
},  
"host": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"loglevel": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"message": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"module": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"pid": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"syslog\_message": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"tags": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},  
"timestamp": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
}  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 26, 2018, 11:12am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/16 "2018-11-26T11:12:45Z")

</div>

That looks correct to me! Can you try another IP address instead?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 26, 2018, 11:18am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/17 "2018-11-26T11:18:26Z")

</div>

> [@prakas](#):
>
> But the actual value for 14.143.35.10 should have been lat:12.9833, lon:77.5833 ([https://ipinfo.io/](https://ipinfo.io/)).  
> When i checked the GeoLite2-City-Blocks-IPv4.csv, i dont find an entry for 14.143.35.10. So how does that work? Does it apply some rules based on available IPs and come up with some value?  
> Is there a way to change it?

The value you are getting seems to be what is in the bundled default database. If you need additional precision, it is possible to run it with non-default databases as well.

---

<div class="post-metadata">

**Author:** ![prakas](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@prakas](https://discuss.elastic.co/u/prakas)\
**Post date:** [November 26, 2018, 11:31am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/18 "2018-11-26T11:31:19Z")

</div>

Just trying to understand, what happens if there is no match for the IP Address in the DB?  
Other than maxmind DBs, are there anything else that is supported?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 26, 2018, 11:33am UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/19 "2018-11-26T11:33:22Z")

</div>

I have never used anything but the default, but would recommend checking out [the docs](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#_supported_databases). It seems like at least commercial MaxMind databases are supported, but am not sure if there are other free compatible options available.

---

<div class="post-metadata">

**Author:** ![prakas](https://avatars.discourse-cdn.com/v4/letter/p/eb9ed0/32.png) [@prakas](https://discuss.elastic.co/u/prakas)\
**Post date:** [November 26, 2018, 1:43pm UTC](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132/20 "2018-11-26T13:43:53Z")

</div>

> [@Christian\_Dahlqvist](#):
>
> I have never used anything but the default, but would recommend checking out [the docs](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#_supported_databases). It seems like at least commercial MaxMind databases are supported, but am not sure if there are other free compatible options available.

Thanks!

[Next page](https://discuss.elastic.co/t/geoip-lat-lon-fields-are-numbers-instead-of-float/158132.md?page=2)