# Geoip.location field not generated

**URL:** <https://discuss.elastic.co/t/geoip-location-field-not-generated/174312>\
**Category:** Logstash\
**Created:** [March 28, 2019, 10:57am UTC](https://discuss.elastic.co/t/geoip-location-field-not-generated/174312 "2019-03-28T10:57:15Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![hannibal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hannibal/32/135263_2.png) [@hannibal](https://discuss.elastic.co/u/hannibal)\
**Post date:** [March 28, 2019, 10:57am UTC](https://discuss.elastic.co/t/geoip-location-field-not-generated/174312/1 "2019-03-28T10:57:16Z")

</div>

Hi everyone,

I'm trying to play with geoip data and I have a trouble with the field `geoip.location`.  
According to the documentation

> A `[geoip][location]` field is created if the GeoIP lookup returns a latitude and longitude.  
> ref: [Geoip filter plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html)

But if I try to check the existance of this field:

```
GET /_all/_search
{
     "query": {
          "exists": {
              "field": "geoip.location"
          }
    }
}
------
{
  "took" : 4,
  "timed_out" : false,
  "_shards" : {
    "total" : 25,
    "successful" : 25,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : null,
    "hits" : []
  }
}

```

But if I search for latitude of longitude fields, I have them

```
GET /_all/_search
{
     "query": {
          "exists": {
              "field": "geoip.latitude"
          }
    }
}

------
{

  "hits" : {
    "total" : 3494,
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "test-2019.02",
        "_type" : "doc",
        "_id" : "ZJFNqGgB8uxQXBeikvih",
        "_score" : 1.0,
        "_source" : {
          "geoip" : {
            "country_code2" : "FR",
            "longitude" : 6.3387000000000002,
            "country_code3" : "FR",
            "latitude" : 49.8582,
            "country_name" : "France"
          },
          "tags" : [ ....

```

I have this basic logstash configuration

```
geoip { 
            fields => [
                "country_code2",
                "country_code3",
                "country_name",
                "latitude",
                "longitude"
            ]
            source => "host"
        }

```

In my index pattern, it seems to be present ..... (the IP also, I haven in reality)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/6/e6112ee854486726c55d0a96a0e5274b05eabcf2.png)

So do you know where I did a mistake ?

Thanks in advance for your help 😉

---

<div class="post-metadata">

**Author:** ![pup\_seba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pup_seba/32/42988_2.png) [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\
**Post date:** [March 28, 2019, 11:16am UTC](https://discuss.elastic.co/t/geoip-location-field-not-generated/174312/2 "2019-03-28T11:16:41Z")

</div>

Hi,

The one time this happened to me, was because i did not installed the geoip plugin in the elasticsearch server. Could it be your case also?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 28, 2019, 12:18pm UTC](https://discuss.elastic.co/t/geoip-location-field-not-generated/174312/3 "2019-03-28T12:18:02Z")

</div>

My reading of the [code](https://github.com/logstash-plugins/logstash-filter-geoip/blob/100b3ad9bb0941d197e8f5e2d67b1792d225cdea/src/main/java/org/logstash/filters/GeoIPFilter.java#L277) is that location is only added if it is one the desired fields. You do not include it in your fields option, so it is not on the desired list.

---

<div class="post-metadata">

**Author:** ![hannibal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hannibal/32/135263_2.png) [@hannibal](https://discuss.elastic.co/u/hannibal)\
**Post date:** [March 28, 2019, 1:05pm UTC](https://discuss.elastic.co/t/geoip-location-field-not-generated/174312/4 "2019-03-28T13:05:12Z")

</div>

Hum, it's quite strange because location field seems to not be a valid option (according to the doc)

> For the built-in GeoLite2 City database, the following are available: `city_name` , `continent_code` , `country_code2` , `country_code3` , `country_name` , `dma_code` , `ip` , `latitude` , `longitude` , `postal_code` , `region_name` and `timezone` .

So I will try all the same

---

<div class="post-metadata">

**Author:** ![hannibal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hannibal/32/135263_2.png) [@hannibal](https://discuss.elastic.co/u/hannibal)\
**Post date:** [March 28, 2019, 1:10pm UTC](https://discuss.elastic.co/t/geoip-location-field-not-generated/174312/5 "2019-03-28T13:10:59Z")

</div>

Hi,  
It seems to be installed

```
> /usr/share/logstash/bin/logstash-plugin list 'geoip'
logstash-filter-geoip
```

---

<div class="post-metadata">

**Author:** ![hannibal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hannibal/32/135263_2.png) [@hannibal](https://discuss.elastic.co/u/hannibal)\
**Post date:** [March 28, 2019, 2:23pm UTC](https://discuss.elastic.co/t/geoip-location-field-not-generated/174312/6 "2019-03-28T14:23:24Z")

</div>

So You are write, the field is not present in the documentation [but exist in the code](https://github.com/logstash-plugins/logstash-filter-geoip/blob/100b3ad9bb0941d197e8f5e2d67b1792d225cdea/src/main/java/org/logstash/filters/Fields.java#L42)

So there is a bug inside the documentation.  
Thanks for your help 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2019, 2:23pm UTC](https://discuss.elastic.co/t/geoip-location-field-not-generated/174312/7 "2019-04-25T14:23:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.