# GeoIP LookUp failure
**URL:** https://discuss.elastic.co/t/geoip-lookup-failure/134936
**Category:** Logstash
**Created:** [June 7, 2018, 9:09am UTC](https://discuss.elastic.co/t/geoip-lookup-failure/134936 "2018-06-07T09:09:15Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@asajj](https://discuss.elastic.co/u/asajj)
#### Post date: [June 7, 2018, 9:09am UTC](https://discuss.elastic.co/t/geoip-lookup-failure/134936/1 "2018-06-07T09:09:15Z")
Hi Everyone,
i'm playing a bit with the ELK-Stack and i have a problem with the GeoIP-Filte of Logstash.
Via Winlogbeat I send EventLogs (more exact Network Sysmon Events). If a connection is established in generates a Event with the "DestinationIp". I want to GeoIP this adress. In ElasticSearch the Event looks like this:
```
{
"_index" : "windows_records-2018.06.06",
"_type" : "wineventlog",
"_id" : "AWPSjUxSYiQHMjlX73pg",
"_score" : 1.0,
"_source" : {
"computer_name" : "DESKTOP-XXXX",
"process_id" : 2876,
"log_name" : "Microsoft-Windows-Sysmon/Operational",
"level" : "Informationen",
"record_number" : "4066",
"event_data" : {
"User" : "NT-AUTORITÄT\\SYSTEM",
"SourceHostname" : "DESKTOP-XXXXX",
"SourcePort" : "50992",
"Image" : "C:\\Windows\\System32\\svchost.exe",
"DestinationPort" : "443",
"ProcessGuid" : "{6AD2706A-835F-5B15-0000-001019371F00}",
"DestinationPortName" : "https",
"UtcTime" : "2018-06-06 00:44:19.113",
"DestinationIp" : "52.114.XX.XX",
```
I thought the only thing to do specify in Logstash this:
```
filter {
geoip {
source => DestinationIp
}
}
```
Because in Kibana the field is called "event\_data.DestinationIp" i tried this also in my logstash configuration with and without quotation marks. However i always got the tag "\_geoip\_lookup\_failure" in the document.
I also tried to push it in a new index, but nothing help.
In my understanding logstash needs for geoip a string with an IPv4/IPv6 address which should specified with "source" in the Logstash configuration.
I have ElasticSearch "5.6.9" and ingest-geoip plugin installed
Thanks at all.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 7, 2018, 10:35am UTC](https://discuss.elastic.co/t/geoip-lookup-failure/134936/2 "2018-06-07T10:35:00Z")
Does it work if you use this?
```
source => "[event_data][DestinationIp]"
```
---
### Author:  [@asajj](https://discuss.elastic.co/u/asajj)
#### Post date: [June 8, 2018, 11:41am UTC](https://discuss.elastic.co/t/geoip-lookup-failure/134936/3 "2018-06-08T11:41:57Z")
Thank you very much! It works!
Sometimes it could be so easy.
---
### Author:  [@asajj](https://discuss.elastic.co/u/asajj)
#### Post date: [June 8, 2018, 2:56pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure/134936/4 "2018-06-08T14:56:58Z")
Alright my Kibana has now the correct coordinates like
But if i want to set up some map visualizations with Kibana it says:
No Compatible Fields: The "windows\_records-\*" index pattern does not contain any of the following field types: geo\_point
This means in my opinion i need field with "long" and "lat" as values and type "geo\_point" so i tried these in Logstash:
> filter {
> geoip {
> source =\> "[event\_data][DestinationIp]"
> add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
> add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
> }
> convert {
> convert =\> ["[geoip][coordinates]", "geo\_point" ]
> }
> }
But with this my Logstash won't start because of "Problems loading a plugin", "Cannot create Pipeline"
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 8, 2018, 3:01pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure/134936/5 "2018-06-08T15:01:20Z")
I think you meant that first convert to be a mutate, but that's not going to work either because you cannot convert to geo\_point. You need an index template that defines your field as a geo\_point. [This](https://discuss.elastic.co/t/location-dosent-convert-to-geo-point/131199) thread might help you.
---
### Author:  [@asajj](https://discuss.elastic.co/u/asajj)
#### Post date: [June 8, 2018, 3:03pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure/134936/6 "2018-06-08T15:03:59Z")
Yes, i mean convert. Thanks for fast response. I try it. Thank you very much again
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2018, 3:04pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure/134936/7 "2018-07-06T15:04:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.