# Given IP is not an ip literal string

**URL:** <https://discuss.elastic.co/t/given-ip-is-not-an-ip-literal-string/80213>\
**Category:** Elasticsearch\
**Created:** [March 27, 2017, 11:28pm UTC](https://discuss.elastic.co/t/given-ip-is-not-an-ip-literal-string/80213 "2017-03-27T23:28:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dirkadin](https://avatars.discourse-cdn.com/v4/letter/d/7993a0/32.png) [@Dirkadin](https://discuss.elastic.co/u/Dirkadin)\
**Post date:** [March 27, 2017, 11:28pm UTC](https://discuss.elastic.co/t/given-ip-is-not-an-ip-literal-string/80213/1 "2017-03-27T23:28:15Z")

</div>

I'm sending a CSV file through Filebeat and Logstash to Elasticsearch. I'm trying to get ip address put into the ip datatype so I can use the geoip feature and heat map in Kibana (like in the video tutorial). I'm very new to the elastic family of products, so apologies in advanced if this is something simple I missed.

Thanks!

**Here is a row of data I'm importing:**  
11/2/16 12:00 AM,DELETED,28bcac10-339e-4af9-97d5-373687959015,8.3.133.78,30.66.0.184,US,"BOUNCEBLOCK, BOUNCELOOP, HELOBOGUS, RETURNPATH, WEIGHT10, WEIGHT15, WEIGHT20, WEIGHT30"

**Here is the template I'm using:**

PUT /\_template/my-logs  
{  
"template": "my-logs",  
"order": 1,  
"settings": {  
"index": {  
"refresh\_interval": "5s"  
}  
},  
"mappings": {  
"default": {  
"\_all": {  
"norms": false,  
"enabled": true  
},  
"properties": {  
"sending-ip": { "type": "ip"},  
"receiving-ip": { "type": "ip"}  
}  
}  
}  
}

**And here is the logstash config in case that helps**  
input {  
beats {  
port =\> "5043"  
}  
}  
filter {  
csv {  
columns =\> ["date-time","message-class","unique-message-id","sending-ip","receiving-ip","origin-country","tests-failed"]  
}  
date {  
match =\> ["date-time", "MM/dd/yy hh:mm aa"]  
}

}  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "my-logs"  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![johtani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/johtani/32/44956_2.png) [@johtani](https://discuss.elastic.co/u/johtani)\
**Post date:** [March 28, 2017, 9:38am UTC](https://discuss.elastic.co/t/given-ip-is-not-an-ip-literal-string/80213/2 "2017-03-28T09:38:30Z")

</div>

You should read [https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html#configuring-geoip-plugin](https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html#configuring-geoip-plugin) .  
Elasticsearch's IP datatype can not add any geographic location information.

---

<div class="post-metadata">

**Author:** ![Dirkadin](https://avatars.discourse-cdn.com/v4/letter/d/7993a0/32.png) [@Dirkadin](https://discuss.elastic.co/u/Dirkadin)\
**Post date:** [March 28, 2017, 2:37pm UTC](https://discuss.elastic.co/t/given-ip-is-not-an-ip-literal-string/80213/3 "2017-03-28T14:37:21Z")

</div>

Thanks for the quick reply! I have tried this before with the same error in Elasticsearch; however, I tried it again this morning and noticed I am getting "Invalid IP address or hostname" errors in Logstash. I guess I will make a post over in the Logstash area.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2017, 2:37pm UTC](https://discuss.elastic.co/t/given-ip-is-not-an-ip-literal-string/80213/4 "2017-04-25T14:37:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.