# GeoIP with JSON

**URL:** <https://discuss.elastic.co/t/geoip-with-json/135250>\
**Category:** Logstash\
**Created:** [June 10, 2018, 1:06am UTC](https://discuss.elastic.co/t/geoip-with-json/135250 "2018-06-10T01:06:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JeMunos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jemunos/32/32664_2.png) [@JeMunos](https://discuss.elastic.co/u/JeMunos)\
**Post date:** [June 10, 2018, 1:06am UTC](https://discuss.elastic.co/t/geoip-with-json/135250/1 "2018-06-10T01:06:48Z")

</div>

I'm having some difficulty pushing the correct field from my json to the GeoIP filter module. My goal is to add the GeoIP data to each event as it comes in. I've been trying to test this using the following config file. However every time I get [0]\_geoip\_lookup\_failure  
Please advise

My json looks like this: {"computer": {"ip": "8.8.8.8"}}

input {  
stdin{  
codec =\> "json"  
}  
}  
filter{  
geoip {  
source =\> "%{[computer][ip]}"  
target =\> "[GeoIP]"  
}  
}  
}  
output {  
stdout {  
codec =\> rubydebug  
}  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 10, 2018, 1:56am UTC](https://discuss.elastic.co/t/geoip-with-json/135250/2 "2018-06-10T01:56:27Z")

</div>

The source to the geoip filter says to substitute the value of the [computer][ip] field for the _name_ of the source. That is not what you want.

```auto
geoip {
    source => "[computer][ip]"
    target => "[GeoIP]"
}

```

---

<div class="post-metadata">

**Author:** ![JeMunos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jemunos/32/32664_2.png) [@JeMunos](https://discuss.elastic.co/u/JeMunos)\
**Post date:** [June 10, 2018, 2:05am UTC](https://discuss.elastic.co/t/geoip-with-json/135250/3 "2018-06-10T02:05:54Z")

</div>

I could swear I had tried that in the variations I tried. Evidently I danced around it. Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 8, 2018, 2:16am UTC](https://discuss.elastic.co/t/geoip-with-json/135250/4 "2018-07-08T02:16:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.