# GeoIP lookup without logstash or ingestnode pipeline **URL:** \ **Category:** Kibana\ **Created:** [April 2, 2018, 5:59am UTC](https://discuss.elastic.co/t/geoip-lookup-without-logstash-or-ingestnode-pipeline/126376 "2018-04-02T05:59:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![meetdave2611997](https://avatars.discourse-cdn.com/v4/letter/m/f07891/32.png) [@meetdave2611997](https://discuss.elastic.co/u/meetdave2611997)\ **Post date:** [April 2, 2018, 5:59am UTC](https://discuss.elastic.co/t/geoip-lookup-without-logstash-or-ingestnode-pipeline/126376/1 "2018-04-02T05:59:11Z")
I want to do exactly what geoIP filter does in logstash and elasticsearch's pipeline but i dont have either . I have one forwarder configured which is using elasticsearch's bulk api to ingest data. Now i want to create coordinate map in kibana which requires geo point data type. Is there any way i can get coordinates of ipaddress in kibana? Thanks, Meet Dave ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 2, 2018, 7:14am UTC](https://discuss.elastic.co/t/geoip-lookup-without-logstash-or-ingestnode-pipeline/126376/2 "2018-04-02T07:14:29Z")
No, there is not. You will need to add this information to the documents during indexing. Can you not modify the ingest process to include Logstash or an ingest pipeline? ---
**Author:** ![meetdave2611997](https://avatars.discourse-cdn.com/v4/letter/m/f07891/32.png) [@meetdave2611997](https://discuss.elastic.co/u/meetdave2611997)\ **Post date:** [April 10, 2018, 8:23pm UTC](https://discuss.elastic.co/t/geoip-lookup-without-logstash-or-ingestnode-pipeline/126376/3 "2018-04-10T20:23:05Z")
Data is coming from another source and I don't have control on that ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 10, 2018, 8:48pm UTC](https://discuss.elastic.co/t/geoip-lookup-without-logstash-or-ingestnode-pipeline/126376/4 "2018-04-10T20:48:50Z")
Then I unfortunately don't see any good way to achieve what you are looking for. ---
**Author:** ![meetdave2611997](https://avatars.discourse-cdn.com/v4/letter/m/f07891/32.png) [@meetdave2611997](https://discuss.elastic.co/u/meetdave2611997)\ **Post date:** [April 11, 2018, 8:15am UTC](https://discuss.elastic.co/t/geoip-lookup-without-logstash-or-ingestnode-pipeline/126376/5 "2018-04-11T08:15:23Z")
Okay thank you ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 11, 2018, 8:42am UTC](https://discuss.elastic.co/t/geoip-lookup-without-logstash-or-ingestnode-pipeline/126376/6 "2018-04-11T08:42:28Z")
One thing you might be able do is to periodically run an [update by query](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/docs-update-by-query.html) job that selects all documents that do not already have geoip fields and then use an ingest pipeline to update them. This reprocessing will however add additional load and lag a bit. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 9, 2018, 8:42am UTC](https://discuss.elastic.co/t/geoip-lookup-without-logstash-or-ingestnode-pipeline/126376/7 "2018-05-09T08:42:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.