# Grokparsefailure, Geoip lookup failure error

**URL:** <https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure-error/177568>\
**Category:** Logstash\
**Created:** [April 19, 2019, 6:05am UTC](https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure-error/177568 "2019-04-19T06:05:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![khergner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khergner/32/130758_2.png) [@khergner](https://discuss.elastic.co/u/khergner)\
**Post date:** [April 19, 2019, 6:05am UTC](https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure-error/177568/1 "2019-04-19T06:05:27Z")

</div>

Hi,  
I searched but could not solution. Why don't know error get [Grokparsefailure, Geoip lookup failure] I don't understansd where the error is. I think grok pattern because used online grok tester so correct data.I installed geo ip plugin but not parse;  
Kind regards

**Exm Data**  
`95.101.1.86 "18/Apr/2019:13:21:55 +0300" "GET /aaa.ts HTTP/1.1" 200 902776 95.5.11.75 "95.5.11.75, 195.175.115.29" MISS "-" 0.169 "0.000" "0.012" "0.030"`  
**Logstash Conf;**

```
input {
   file {
      path => ["C:/Elasticsearch/logstash-6.6.1/akamai/access.log"]
	  start_position => "beginning"
	  sincedb_path => "nul"
	  type => "router"
   }
}

filter {
 if [type] == "router"{
   grok {
     match => {
       "message" => "%{IP:remoteAddr}%{SPACE}\"%{HTTPDATE:time_local}\"%{SPACE}\"(?:%{WORD:http_method}%{SPACE}%{NOTSPACE:request}(?:%{SPACE}HTTP/%{NUMBER:httpversion})?|-)\"%{SPACE}%{NUMBER:status:int}%{SPACE}%{NUMBER:body_bytes:int}%{SPACE}%{DATA:client_addr}%{SPACE}\"%{DATA:http_x_fowarded_for}\"%{SPACE}%{WORD:upstream_cache_status}%{SPACE}\"(%{DATA:upstream_cache_control})\"%{SPACE}%{NUMBER:request_time:float}%{SPACE}\"%{NUMBER:upstream_connect_time:float}\"%{SPACE}\"%{NUMBER:upstream_header_time:float}\"%{SPACE}\"%{DATA:upstream_response_time}"
     }
   remove_field => ["message"]
   }
   date {
     match => ["time_local", "dd/MMM/YYYY:H:m:s Z"]
     remove_field => "time_local"
    }
   mutate {
     add_field => {
       "[es_index]" => "router"
     }
   }
   geoip {
     source => "remoteAddr"
     target => "geoip"
   }
 }
}
output {
   file {
      path => "C:/Elasticsearch/logstash-6.6.1/output.log"
   }
}

```

**Result tags;**  
"tags":["\_grokparsefailure","\_geoip\_lookup\_failure"],

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 19, 2019, 2:03pm UTC](https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure-error/177568/2 "2019-04-19T14:03:54Z")

</div>

For

```
95.101.1.86 "18/Apr/2019:13:21:55 +0300" "GET /aaa.ts HTTP/1.1" 200 902776 95.5.11.75 "95.5.11.75,195.175.115.29" MISS "-" 0.169 "0.000" "0.012" "0.030"

```

that grok parses just fine for me...

```
                "status" => 200,
           "client_addr" => "95.5.11.75",
 "upstream_connect_time" => 0.0,
            "remoteAddr" => "95.101.1.86",
            [...]

```

and once remoteAddr exists geoip finds it

```
          "location" => {
        "lon" => 8.0,
        "lat" => 47.0
    },
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 17, 2019, 2:03pm UTC](https://discuss.elastic.co/t/grokparsefailure-geoip-lookup-failure-error/177568/3 "2019-05-17T14:03:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.