# GeoIp-problems **URL:** \ **Category:** Logstash\ **Created:** [January 22, 2018, 11:23am UTC](https://discuss.elastic.co/t/geoip-problems/116472 "2018-01-22T11:23:45Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![eebee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eebee/32/26799_2.png) [@eebee](https://discuss.elastic.co/u/eebee)\ **Post date:** [January 22, 2018, 11:23am UTC](https://discuss.elastic.co/t/geoip-problems/116472/1 "2018-01-22T11:23:45Z")
I'm trying to filter out the GeoIp from the log I'm ingesting into Elasticsearch. The log pattern is like this: `{"@message":"Successful api request","@timestamp":"2018-01-22T08:24:00.162Z","@fields":{"origin":"193.xx.xx.xxx","environment":"production_beta","label":"askquestiongui","level":"info"}}` I've tested with this filter setting without any luck: `filter { geoip { source => "@fields.origin.keyword" } }` Output: `{ "@version" => "1", "http_poller_metadata" => { "request" => { "headers" => { "Accept" => "application/json", "x-lm-api" => "xxxxxxxxxxxxxxxxxxxxxxxxx" }, "method" => "get", "url" => "http://xx.xx.xx/xx/log" }, "response_headers" => { "date" => "Mon, 22 Jan 2018 11:21:05 GMT", "x-global-transaction-id" => "139098999", "last-modified" => "Mon, 22 Jan 2018 11:20:05 GMT", "x-backside-transport" => "OK OK", "transfer-encoding" => "chunked", "x-powered-by" => "Express", "connection" => "Keep-Alive", "content-type" => "text/plain; charset=UTF-8", "etag" => "W/\"5948-1611d98bf6a\"", "cache-control" => "public, max-age=0" }, "code" => 200, "response_message" => "OK", "times_retried" => 0, "runtime_seconds" => 5.095, "name" => "test", "host" => "elastic6" }, "@message" => "Successful api request", "@timestamp" => 2018-01-22T11:20:05.226Z, "@fields" => { "environment" => "production_beta", "label" => "askquestiongui", "level" => "info", "origin" => "193.xx.xx.xxx" }, "tags" => [[0] "_geoip_lookup_failure" ] }` I'm using Elasticsearch 5.6.4 and ingest-geoip is installed. ---
**Author:** ![jordansissel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jordansissel/32/44957_2.png) [@jordansissel](https://discuss.elastic.co/u/jordansissel)\ **Post date:** [January 22, 2018, 7:09pm UTC](https://discuss.elastic.co/t/geoip-problems/116472/2 "2018-01-22T19:09:27Z")
> [@eebee](#): > > { source =\> "@fields.origin.keyword" } } This syntax `@fields.origin.keyword` is not correct for Logstash and looks more like Elasticsearch syntax? That said, your object looks like this: ```auto "@fields":{"origin":"193.xx.xx.xxx" } ``` To access the 'origin' value you will need to use a [field reference](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references), and it'll look like this: ```auto filter { geoip { source => "[@fields][origin]" } } ``` ---
**Author:** ![eebee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eebee/32/26799_2.png) [@eebee](https://discuss.elastic.co/u/eebee)\ **Post date:** [January 23, 2018, 7:32am UTC](https://discuss.elastic.co/t/geoip-problems/116472/3 "2018-01-23T07:32:18Z")
That did the trick! Thanks alot for the help! 🙂 ---
**Author:** ![eebee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eebee/32/26799_2.png) [@eebee](https://discuss.elastic.co/u/eebee)\ **Post date:** [January 23, 2018, 9:22am UTC](https://discuss.elastic.co/t/geoip-problems/116472/4 "2018-01-23T09:22:58Z")
And another strange thing... When I get the coordinates on my map, they are way of from where they should be. "location" =\> "18.056,59.3247" should be in Sweden, but shows up in the Indian Ocean. Filter: > filter > { > geoip { > source =\> "[@fields][origin]" > target =\> "geoip" > add\_field =\> ["[geoip][location2]", "%{[geoip][longitude]}" ] > add\_field =\> ["[geoip][location2]", "%{[geoip][latitude]}" ] > } > mutate { > replace =\> ["[geoip][location]", "%{[geoip][location2]}" ] > } > } Output in index: > geoip.city\_name: Gävle > geoip.continent\_code: EU > geoip.country\_code2: SE > geoip.country\_code3: SE > geoip.country\_name: Sweden > geoip.ip: xxx.xx.xxx.xxx > geoip.latitude: 60.667 > geoip.location: 17.1667,60.6667 > geoip.location2: 17.1667, 60.6667 > geoip.longitude: 17.167 > geoip.postal\_code: 800 10 > geoip.region\_code: X > geoip.region\_name: Gävleborg > geoip.timezone: Europe/Stockholm ---
**Author:** ![eebee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eebee/32/26799_2.png) [@eebee](https://discuss.elastic.co/u/eebee)\ **Post date:** [January 23, 2018, 1:58pm UTC](https://discuss.elastic.co/t/geoip-problems/116472/5 "2018-01-23T13:58:55Z")
Found the problem. Geoip had flipped long and lat for me. 😉 ---
**Author:** ![jordansissel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jordansissel/32/44957_2.png) [@jordansissel](https://discuss.elastic.co/u/jordansissel)\ **Post date:** [February 2, 2018, 6:06am UTC](https://discuss.elastic.co/t/geoip-problems/116472/6 "2018-02-02T06:06:42Z")
> [@eebee](#): > > add\_field =\> ["[geoip][location2]", "%{[geoip][longitude]}" ] > > add\_field =\> ["[geoip][location2]", "%{[geoip][latitude]}" ] It looks like you're trying to build a GeoJSON value `[longitude, latitude]`, but the geoip plugin already provides this, so there's no need for you to build this by hand as you are doing and it stores it as the 'location' field in `{ "lat": ..., "lon": ... }` value that Elasticsearch and Kibana both understand: Inputting some random IP 193.1.2.3: ```auto { "geoip" => { "continent_code" => "EU", "location" => { "lat" => 53.3472, "lon" => -6.2439 }, "country_code2" => "IE", "latitude" => 53.3472, "country_name" => "Ireland", "country_code3" => "IE", "ip" => "193.1.2.3", "timezone" => "Europe/Dublin", "longitude" => -6.2439 }, "message" => "193.1.2.3", "@version" => "1", "@timestamp" => 2018-02-01T16:47:48.697Z, "host" => "fancypants", "type" => "stdin" } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 2, 2018, 6:06am UTC](https://discuss.elastic.co/t/geoip-problems/116472/7 "2018-03-02T06:06:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.