# Geoip on custom field

**URL:** <https://discuss.elastic.co/t/geoip-on-custom-field/205672>\
**Category:** Logstash\
**Created:** [October 29, 2019, 1:03pm UTC](https://discuss.elastic.co/t/geoip-on-custom-field/205672 "2019-10-29T13:03:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![hannibal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hannibal/32/135263_2.png) [@hannibal](https://discuss.elastic.co/u/hannibal)\
**Post date:** [October 29, 2019, 1:03pm UTC](https://discuss.elastic.co/t/geoip-on-custom-field/205672/1 "2019-10-29T13:03:32Z")

</div>

Hi everyone,

I'm trying to use the geoIP filter on x\_forwarded\_for header.  
So my pipeline is quiet easy, I use an HTTP input, and try to use the field x\_forwarded\_for which are in headers parts for the geoip filtering.

```
geoip {
       fields => [
            "country_code2",
            "country_code3",
            "country_name",
            "location"
        ]
        source => "x_forwarded_for" 
   
    }

```

In source, I have tried `%{[headers][x_forwarded_for]}"` or `[headers][x_forwarded_for]` (I don't know the right way to access to the field ) but nothings work. Sometimes it's not compiling or sometimes, I will have `_geoip_lookup_failure` tag.

My rubydebug log is something like

```
"headers" => {
 "content_length" => "455",
 "content_type" => "application/json",
 "client_host" => "xx.xx.xx.xx",
 "http_user_agent" => nil,
 "http_version" => "HTTP/1.1",
 "request_path" => "/",
 "request_method" => "POST",
 "http_accept" => "*/*",
 "http_host" => "myhost.com",
 "x_forwarded_for" => "xx.xx.xx.xx"
 }

```

So do you know how I can use `x_forwarded_for` ?

Thanks in advance for your help

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 29, 2019, 2:18pm UTC](https://discuss.elastic.co/t/geoip-on-custom-field/205672/2 "2019-10-29T14:18:22Z")

</div>

```
source => "[headers][x_forwarded_for]"

```

should work if that is what your data looks like.

---

<div class="post-metadata">

**Author:** ![hannibal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hannibal/32/135263_2.png) [@hannibal](https://discuss.elastic.co/u/hannibal)\
**Post date:** [October 29, 2019, 2:29pm UTC](https://discuss.elastic.co/t/geoip-on-custom-field/205672/3 "2019-10-29T14:29:07Z")

</div>

Yeah it's working 😍  
Great thanks for that.

Ps: How do you know whitch syntaxe must be used ?  
(for example, I use `%{[headers][x_forwarded_for]}"` in cidr filter and it's working)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 29, 2019, 3:43pm UTC](https://discuss.elastic.co/t/geoip-on-custom-field/205672/4 "2019-10-29T15:43:43Z")

</div>

That's a good question! Some filters expect the name of a field, which would be "[headers][x\_forwarded\_for]", and some expect a value, which would be "%{[headers][x\_forwarded\_for]}". I had never noticed that distinction before. I guess you just have to follow the lead of the documentation.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2019, 3:43pm UTC](https://discuss.elastic.co/t/geoip-on-custom-field/205672/5 "2019-11-26T15:43:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.