# GeoIP output IPs to file
**URL:** https://discuss.elastic.co/t/geoip-output-ips-to-file/2534
**Category:** Logstash
**Created:** [June 12, 2015, 2:01am UTC](https://discuss.elastic.co/t/geoip-output-ips-to-file/2534 "2015-06-12T02:01:51Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@gromit](https://discuss.elastic.co/u/gromit)
#### Post date: [June 12, 2015, 2:01am UTC](https://discuss.elastic.co/t/geoip-output-ips-to-file/2534/1 "2015-06-12T02:01:51Z")
I would like to output just the geoip.ip field to file (just the IP address).
I have tried the following but just get errors. I think the ip is a nested field of geoip, but not sure how to extract.
file {
message\_format =\> ["%{geoip.ip}"]
path =\> "/var/log/logstash/geoip\_ip.%{+yyyy.MM.dd.HH}"
}
}
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [June 12, 2015, 3:35am UTC](https://discuss.elastic.co/t/geoip-output-ips-to-file/2534/2 "2015-06-12T03:35:25Z")
Did you delete the source IP that you used to generate the GeoIP object? Why do you need this field?
At any rate, you'll need to use the syntax for sub-fields:
`message_format => ["%{[geoip][ip]"]`
**UPDATE:** It appears I missed the closing curly brace: `message_format => ["%{[geoip][ip]}"]`
---
### Author:  [@gromit](https://discuss.elastic.co/u/gromit)
#### Post date: [June 12, 2015, 4:58am UTC](https://discuss.elastic.co/t/geoip-output-ips-to-file/2534/3 "2015-06-12T04:58:45Z")
Great thanks for that! The issue I had was that there was no source IP, only source host name, which geoip converts to IP. These IP's I need in a log file for further analysis.
---
### Author:  [@gromit](https://discuss.elastic.co/u/gromit)
#### Post date: [June 12, 2015, 5:49am UTC](https://discuss.elastic.co/t/geoip-output-ips-to-file/2534/4 "2015-06-12T05:49:38Z")
Except that the syntax is:
message\_format =\> ["%{geoip[ip]}"]
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [June 12, 2015, 3:15pm UTC](https://discuss.elastic.co/t/geoip-output-ips-to-file/2534/5 "2015-06-12T15:15:39Z")
Really? That shouldn't even work. [`sprintf` field reference formatting](https://www.elastic.co/guide/en/logstash/current/configuration.html#sprintf) indicates that nested references should be `"%{[primary_field][subfield]}"`.
Can you confirm that the `message_format` doesn't work with `"%{[geoip][ip]}"` and does with `"%{geoip[ip]}"`?
---
### Author:  [@gromit](https://discuss.elastic.co/u/gromit)
#### Post date: [June 13, 2015, 8:51am UTC](https://discuss.elastic.co/t/geoip-output-ips-to-file/2534/6 "2015-06-13T08:51:32Z")
Well, When I tried "%{[geoip][ip]}" the output file was populated with [geoip][ip] on every line. When I tried "%{geoip[ip]}" then the file contained an IP address on every line.
Now I have an issue where if geoip fails to parse the host name the the output line is geoip.ip
Is there a conditional that I can use to only output if the field geoip.ip actually contains an IP address?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:37am UTC](https://discuss.elastic.co/t/geoip-output-ips-to-file/2534/7 "2017-07-06T05:37:30Z")