Geoip with private networks fails with

Elastic Stack Logstash
1

Hi,
I'm having a trouble with mapping private IPs to their geo coordiantes, filter below always fails with error:
"reason"=>"failed to parse field [client.geo.location] of type [geo_point]", "caused_by"=>{"type"=>"parse_exception", "reason"=>"unsupported symbol [.] in geohash [50.9011484]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"unsupported symbol [.] in geohash [50.9011484]"}}}}}}

if [client][geo][ip] =~ /^10\.13\./ or [client][geo][ip] =~ /^10\.86\./ {
                                                mutate {
                                                        add_field      => { "[client][geo][timezone]" => "Europe/Warsaw" }
                                                        add_field      => { "[client][geo][country_name]"  => "Poland" }
                                                        add_field      => { "[client][geo][continent_code]" => "EU" }
                                                        add_field      => { "[client][geo][country_code2]" => "PL" }
                                                        add_field      => { "[client][geo][country_code3]" => "PL" }
                                                        add_field      => { "[client][geo][location]" => { "lat: 50.9011484, lon: 15.8760857"}}
                                                        add_field      => { "[client][geo][latitude]" => "50.9011484" }
                                                        add_field      => { "[client][geo][longitude]" => "15.8760857"}
                                                }
                                        }

I believe that [client][geo][location] is malformatted, but I don't know what kind of format is expected to be honest. Could anyone gimmie a hint here? :slight_smile:
Thank you in advance!

2

Try

    mutate { add_field => { "[client][geo][location][lat]" => 50.9011484 } }
    mutate { add_field => { "[client][geo][location][lon]" => 15.8760857 } }
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.