# \_geoip\_lookup\_failure Error

**URL:** <https://discuss.elastic.co/t/geoip-lookup-failure-error/146348>\
**Category:** Logstash\
**Created:** [August 28, 2018, 1:18pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-error/146348 "2018-08-28T13:18:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ira](https://avatars.discourse-cdn.com/v4/letter/i/9fc348/32.png) [@Ira](https://discuss.elastic.co/u/Ira)\
**Post date:** [August 28, 2018, 1:18pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-error/146348/1 "2018-08-28T13:18:18Z")

</div>

Hi,

I'm trying to add a geoip filter.

My configuration file looks like this:

input {  
beats {  
port =\> "5044"  
}  
}

filter {  
grok{  
match =\> {  
message =\> "%{TIMESTAMP\_ISO8601:timestamp}%{SPACE}[%{DATA:thread}]%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}appName=%{DATA:appName}%{SPACE}globalId=%{UUID:globalId}%{SPACE}%{JAVACLASS:class}-\>%{JAVAMETHOD:method}:%{NUMBER:line}%{SPACE}-%{SPACE}%{JAVALOGMESSAGE:uri}|%{JAVALOGMESSAGE:response}|%{IPORHOST:clientip}"  
}  
add\_field =\> {  
"logType" =\> "message"  
}  
}   
}

filter {  
geoip {  
source =\> "clientip"  
target =\> "geoip"  
}  
}

output {  
if [logType] == "message" {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> ["service-logs-messages-%{+YYYY.MM.dd}"]  
}  
}  
}

And a sample log line looks like this:

2018-08-07 04:52:59.250 [qtp416049054-72] DEBUG appName=rights globalId=5608ddfb-dca1-43e3-aa42-7877346b4342 org.eclipse.jetty.util.thread.QueuedThreadPool-\>run:590 - GET//smukvdev01:8086/season/ID/123|200OK|10.190.30.13

When I view the index, I get the following fields:

```
  {
    "_index" : "service-logs-messages-2018.08.28",
    "_type" : "doc",
    "_id" : "3Hh6gGUBsGhNvNlJ4Iyh",
    "_score" : 1.0,
    "_source" : {
      "globalId" : "5608ddfb-dca1-43e3-aa42-7877346b4342",
      "method" : "run",
      "beat" : {
        "name" : "SMUKVDEV01.sintecmedia.com",
        "version" : "6.3.2",
        "hostname" : "SMUKVDEV01.sintecmedia.com"
      },
      "thread" : "qtp416049054-72",
      "clientip" : "10.190.30.13",
      "prospector" : {
        "type" : "log"
      },
      "input" : {
        "type" : "log"
      },
      "message" : "2018-08-07 04:52:59.250 [qtp416049054-72] DEBUG appName=rights globalId=5608ddfb-dca1-43e3-aa42-7877346b4342 org.eclipse.jetty.util.thread.QueuedThreadPool->run:590 - GET//smukvdev01:8086/season/ID/123|200OK|10.190.30.13",
      "timestamp" : "2018-08-07 04:52:59.250",
      "logType" : "message",
      "tbwweekday" : "2",
      "uri" : "GET//smukvdev01:8086/season/ID/abc",
      "geoip" : { },
      "tags" : [
        "beats_input_codec_plain_applied",
        "_grokparsefailure",
        "_dateparsefailure",
        "_geoip_lookup_failure"
      ],
      "loglevel" : "DEBUG",
      "source" : "/home/elastic/Logs/rights_ira_newFormat.log",
      "response" : "200OK",
      "logdate" : "2018-08-07T04:52:59.250Z",
      "line" : "590",
      "host" : {
        "name" : "SMUKVDEV01.sintecmedia.com"
      },
      "@version" : "1",
      "@timestamp" : "2018-08-28T12:20:58.575Z",
      "offset" : 256,
      "appName" : "rights",
      "class" : "org.eclipse.jetty.util.thread.QueuedThreadPool"
    }
  }

```

I'm getting the \_geoip\_lookup\_failure error and "geoip" is returned empty.

Could you assist with possible solution, please?

Thanks.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 28, 2018, 6:45pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-error/146348/2 "2018-08-28T18:45:48Z")

</div>

The IP address in question is within the private RFC1918 address space and can't possibly be translated to a geographic location.

---

<div class="post-metadata">

**Author:** ![Ira](https://avatars.discourse-cdn.com/v4/letter/i/9fc348/32.png) [@Ira](https://discuss.elastic.co/u/Ira)\
**Post date:** [August 30, 2018, 8:30am UTC](https://discuss.elastic.co/t/geoip-lookup-failure-error/146348/3 "2018-08-30T08:30:50Z")

</div>

Thank you for your response.  
This is exactly the part I missed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2018, 8:30am UTC](https://discuss.elastic.co/t/geoip-lookup-failure-error/146348/4 "2018-09-27T08:30:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.