# \_geoip\_lookup\_failure in Logstash pipeline using GeoLite2-City.mmdb **URL:** \ **Category:** Logstash\ **Created:** [May 18, 2023, 6:33pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-in-logstash-pipeline-using-geolite2-city-mmdb/333802 "2023-05-18T18:33:38Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Carlos\_T](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlos_t/32/97624_2.png) [@Carlos\_T](https://discuss.elastic.co/u/Carlos_T)\ **Post date:** [May 18, 2023, 6:33pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-in-logstash-pipeline-using-geolite2-city-mmdb/333802/1 "2023-05-18T18:33:38Z")
Hi all When trying to enrich the following pipeline of my Logstash 8.4.3 with GeoIP info: ```auto input { file { path => "/var/log/apache2/*.log" start_position => "beginning" } http { } } filter { fingerprint { source => "message" target => "[@metadata][fingerprint]" method => "MD5" } if [log][file][path] =~ "error" { mutate { replace => { type => "error" } } } else { mutate { replace => { type => "access" } } grok { match => { "message" => "%{HTTPD_COMMONLOG}" } } if "_grokparsefailure" in [tags] { drop {} } mutate { convert => { "response" => "integer" "bytes" => "integer" } } date { match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"] } geoip { source => "source.address" target => "geoip" database => "/bdgeo/GeoLite2-City.mmdb" # Reemplaza con la ruta correcta a la base de datos de geolocalización } } } output { stdout { codec => rubydebug } file { path => "%{type}_%{+yyyy_MM_dd}.log" } } ``` Then I run the pipeline without error and next I add a line like this to my /var/log/apache2/access.log ```auto 112.85.231.147 - - [18/May/2023:12:26:02 +0200] "GET /miweb.html HTTP/1.1" 200 543 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113.0" ``` And this is the output I get: ```auto { "event" => { "original" => "112.85.231.147 - - [18/May/2023:12:26:02 +0200] \"GET /miweb.html HTTP/1.1\" 200 543 \"-\" \"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113.0\"" }, "@timestamp" => 2023-05-18T10:26:02.000Z, "@version" => "1", "message" => "112.85.231.147 - - [18/May/2023:12:26:02 +0200] \"GET /miweb.html HTTP/1.1\" 200 543 \"-\" \"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113.0\"", "host" => { "name" => "ubuntuelk02" }, "url" => { "original" => "/miweb.html" }, "tags" => [ [0] "_geoip_lookup_failure" ], "http" => { "version" => "1.1", "request" => { "method" => "GET" }, "response" => { "body" => { "bytes" => 543 }, "status_code" => 200 } }, "source" => { "address" => "112.85.231.147" }, "type" => "access", "log" => { "file" => { "path" => "/var/log/apache2/access.log" } }, "timestamp" => "18/May/2023:12:26:02 +0200" } ``` I downloaded the 'GeoLite2 City ' database and I've 'chmod'ed it so the path and the file are reachable and readable. I've tried with different IP's too. Does someone please have any idea about what could be wrong? Thank you in advance. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [May 19, 2023, 8:31am UTC](https://discuss.elastic.co/t/geoip-lookup-failure-in-logstash-pipeline-using-geolite2-city-mmdb/333802/2 "2023-05-19T08:31:23Z")
Most likely is ECS. You should use field [source.ip](https://www.elastic.co/guide/en/ecs/current/ecs-source.html#field-source-ip) or [destination.ip](https://www.elastic.co/guide/en/ecs/current/ecs-destination.html#field-destination-ip) Use: `source => "[source][ip]"` Also is possible to disable ECS. ```auto geoip { source => "source.address" target => "geoip" database => "/bdgeo/GeoLite2-City.mmdb" ecs_compatibility => "disabled" } ``` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [May 19, 2023, 12:37pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-in-logstash-pipeline-using-geolite2-city-mmdb/333802/3 "2023-05-19T12:37:05Z")
> [@Rios](#): > > `source => "source.address"` Also, this needs to be `[source][address]` ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [May 19, 2023, 12:42pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-in-logstash-pipeline-using-geolite2-city-mmdb/333802/4 "2023-05-19T12:42:56Z")
Good point, thx. ---
**Author:** ![Carlos\_T](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlos_t/32/97624_2.png) [@Carlos\_T](https://discuss.elastic.co/u/Carlos_T)\ **Post date:** [May 19, 2023, 11:51pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-in-logstash-pipeline-using-geolite2-city-mmdb/333802/5 "2023-05-19T23:51:35Z")
It was a combination of what you both said: ```auto geoip { source => "[source][address]" target => "geoip" database => "/bdgeo/GeoLite2-City.mmdb" # Reemplaza con la ruta correcta a la base de datos de geolocalización ecs_compatibility => "disabled" } ``` By using this pipeline ![imagen](https://us1.discourse-cdn.com/elastic/original/3X/f/f/ffa86ee594c754635cc0a04caac2e0f6a1cbcadf.png) Thank you very much Rios and Leandro. That was fast an efficient 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 16, 2023, 11:52pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-in-logstash-pipeline-using-geolite2-city-mmdb/333802/6 "2023-06-16T23:52:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.