# Geoip\_lookup\_failure. Tag in kibana

**URL:** <https://discuss.elastic.co/t/geoip-lookup-failure-tag-in-kibana/93503>\
**Category:** Kibana\
**Created:** [July 18, 2017, 6:22am UTC](https://discuss.elastic.co/t/geoip-lookup-failure-tag-in-kibana/93503 "2017-07-18T06:22:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jonesthomas](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\
**Post date:** [July 18, 2017, 6:22am UTC](https://discuss.elastic.co/t/geoip-lookup-failure-tag-in-kibana/93503/1 "2017-07-18T06:22:59Z")

</div>

This is my example file:  
1- Why my currentTimestamp is in string field?  
2-geoip failure

 ![](https://us1.discourse-cdn.com/elastic/original/3X/2/6/26e9c7846321151cf0219ef5aaef5a07669291dc.png)

and the filter i used 👇

filter {  
json {  
source =\> "message"  
}  
json {  
source =\> "LogMsg"  
}  
date {  
match =\> ["currentTimestamp", "dd/MMM/yyyy:HH:mm:ss Z"]  
}  
geoip{  
source =\> "LogMsg"  
}  
}

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [July 19, 2017, 6:21pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-tag-in-kibana/93503/2 "2017-07-19T18:21:28Z")

</div>

FYI, this really isn't a Kibana question, it's about how to configure your Logstash pipeline. You're just using Kibana to inspect the problem. I can offer you some limited help, but if you need further advice, then the Logstash category is what you're looking for.

I formatted the filter for you:

```auto
filter {
  json {
    source => "message"
  }
  json {
    source => "LogMsg"
  }
  date {
    match => ["currentTimestamp", "dd/MMM/yyyy:HH:mm:ss Z"]
  }
  geoip{
    source => "LogMsg"
  }
}

```

> [@Jonesthomas](#):
>
> 1- Why my currentTimestamp is in string field?

The filter alone doesn't ensure that the data is mapped the way you want it to be. If you have an `elasticsearch` output section in your pipeline configuration, you'll want to add a `template` and `template_name` as described in the Logstash docs: [Elasticsearch output plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-options). In the template you specify, make sure to map `currentTimestamp` to be a date field.

> [@Jonesthomas](#):
>
> 2-geoip failure

It looks like you're configuring `source` to be the `LogMsg` field, which is an object, but `source` needs a string which is the IP address to perform the lookup: [Geoip filter plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-source). Unless I'm mistaken, it doesn't look like your data even has IP address data, so `geoip` is not what you want. Looks like you already have the latitude and longitude data, so you just want to take those fields and map them to a geo\_point. See: [Geo-point datatype | Elasticsearch Reference [5.5] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/geo-point.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2017, 6:21pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-tag-in-kibana/93503/3 "2017-08-16T18:21:33Z")

</div>

Closed on August 16, 2017, 6:21pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.