# Help with GeoLocation please!

**URL:** <https://discuss.elastic.co/t/help-with-geolocation-please/53119>\
**Category:** Logstash\
**Created:** [June 17, 2016, 8:22am UTC](https://discuss.elastic.co/t/help-with-geolocation-please/53119 "2016-06-17T08:22:35Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![gott](https://avatars.discourse-cdn.com/v4/letter/g/bbce88/32.png) [@gott](https://discuss.elastic.co/u/gott)\
**Post date:** [June 17, 2016, 8:22am UTC](https://discuss.elastic.co/t/help-with-geolocation-please/53119/1 "2016-06-17T08:22:35Z")

</div>

Looking for some help please. Im new to Elastic and im finding it very enjoyable!!

My elk stack is running on a windows server

ok so my GEO situation is...

Filebeat on a IIS webserver sending iis logs to logstash server. - this works great

logstash is parsing logs and forwarding to Elasticsearch - this also works great (My first time with GROK)

Here is my logstash conf

input {  
beats {  
port =\> 5044  
type =\> "log"  
}  
}

filter {

## Ignore the comments that IIS will add to the start of the W3C logs

# 

if [message] =~ "^#" {  
drop {}  
}

grok {  
## Very helpful site for building these statements:  
# [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/)  
#  
# This is configured to parse out every field of IIS's W3C format when  
# every field is included in the logs  
#  
match =\> ["message", "%{TIMESTAMP\_ISO8601:log\_timestamp} %{WORD:serviceName} %{WORD:serverName} %{IP:serverIP} %{WORD:method} %{URIPATH:uriStem} %{NOTSPACE:uriQuery} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clientIP} %{NOTSPACE:protocolVersion} %{NOTSPACE:userAgent} %{NOTSPACE:cookie} %{NOTSPACE:referer} %{NOTSPACE:requestHost} %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:win32response} %{NUMBER:bytesSent} %{NUMBER:bytesReceived} %{NUMBER:timetaken}"]  
}

## Set the Event Timesteamp from the log

# 

date {  
match =\> ["log\_timestamp", "YYYY-MM-dd HH:mm:ss"]  
timezone =\> "Etc/UTC"  
}

## If the log record has a value for 'bytesSent', then add a new field

# to the event that converts it to kilobytes

# 

if [bytesSent] {  
ruby {  
code =\> "event['kilobytesSent'] = event['bytesSent'].to\_i / 1024.0"  
}  
}

## Do the same conversion for the bytes received value

# 

if [bytesReceived] {  
ruby {  
code =\> "event['kilobytesReceived'] = event['bytesReceived'].to\_i / 1024.0"  
}  
}

## Perform some mutations on the records to prep them for Elastic

# 

mutate {  
## Convert some fields from strings to integers  
#  
convert =\> ["bytesSent", "integer"]  
convert =\> ["bytesReceived", "integer"]  
convert =\> ["timetaken", "integer"]

```
## Create a new field for the reverse DNS lookup below
#
add_field => { "clientHostname" => "%{clientIP}" }

## Finally remove the original log_timestamp field since the event will
# have the proper date on it
#
remove_field => ["log_timestamp"]

```

}

## Do a reverse lookup on the client IP to get their hostname.

# 

dns {  
## Now that we've copied the clientIP into a new field we can  
# simply replace it here using a reverse lookup  
#  
action =\> "replace"  
reverse =\> ["clientHostname"]  
}

## Parse out the user agent

# 

```
useragent {
    source=> "useragent"
    prefix=> "browser"
}

```

geoip {  
source =\> "clientIP"  
target =\> "geoip"  
add\_tag =\> ["iis-geoip"]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}"]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float" ]  
}

}

## We're only going to output these records to Elasticsearch so configure

# that.

# 

output {  
elasticsearch {  
hosts =\> "localhost:9200"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
}

Kibana is displaying the logs great, I can view them in discover and make visualisations. also using some nice templates in the dashboard. All in all im very happy with how its going.

But.. I just cant get any Geo goodness working!! I go to visualise and tilemap, select filebeat for the index and for the bucket i select Geo\_Point then client\_location.

but theres no data to display in the tile map

 ![](https://us1.discourse-cdn.com/elastic/original/2X/3/37a88fb75a033e5314c86fc95bda5943a9ffe220.png)

Heres a copy of the filebeat template.json that i applied against elasticsearch

{  
"mappings": {  
"_default_": {  
"\_all": {  
"enabled": true,  
"norms": {  
"enabled": false  
}  
},  
"dynamic\_templates": [  
{  
"template1": {  
"mapping": {  
"doc\_values": true,  
"ignore\_above": 1024,a  
"index": "not\_analyzed",  
"type": "{dynamic\_type}"  
},  
"match": "_"  
}  
}  
],  
"properties": {  
"@timestamp": {  
"type": "date"  
},  
"client\_location": {  
"type": "geo\_point"  
},  
"message": {  
"type": "string",  
"index": "analyzed"  
},  
"offset": {  
"type": "long",  
"doc\_values": "true"  
}  
}  
}  
},  
"settings": {  
"index.refresh\_interval": "5s"  
},  
"template": "filebeat-_"  
}

any help is much appreciated

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 18, 2016, 1:36am UTC](https://discuss.elastic.co/t/help-with-geolocation-please/53119/2 "2016-06-18T01:36:31Z")

</div>

You are targeting the `geoip` field in your filter, but you have `client_location` in the mapping.  
You need to resolve that discrepancy.

---

<div class="post-metadata">

**Author:** ![gott](https://avatars.discourse-cdn.com/v4/letter/g/bbce88/32.png) [@gott](https://discuss.elastic.co/u/gott)\
**Post date:** [June 18, 2016, 8:27am UTC](https://discuss.elastic.co/t/help-with-geolocation-please/53119/3 "2016-06-18T08:27:20Z")

</div>

Thanks Mark. So could I change the filter to client location? Or should I change the template.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 18, 2016, 9:18am UTC](https://discuss.elastic.co/t/help-with-geolocation-please/53119/4 "2016-06-18T09:18:05Z")

</div>

Either, or, whatever is easier for you really.

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [June 18, 2016, 6:51pm UTC](https://discuss.elastic.co/t/help-with-geolocation-please/53119/5 "2016-06-18T18:51:23Z")

</div>

> [@gott](#):
>
> ## If the log record has a value for 'bytesSent', then add a new field # to the event that converts it to kilobytes # if [bytesSent] { ruby { code =\> "event['kilobytesSent'] = event['bytesSent'].to\_i / 1024.0" } }
> 
> ## Do the same conversion for the bytes received value # if [bytesReceived] { ruby { code =\> "event['kilobytesReceived'] = event['bytesReceived'].to\_i / 1024.0" } }
> 
> ## Perform some mutations on the records to prep them for Elastic # mutate { ## Convert some fields from strings to integers # convert =\> ["bytesSent", "integer"] convert =\> ["bytesReceived", "integer"] convert =\> ["timetaken", "integer"]

Not related to your question, but I find those filter perhaps not necessary and may slow down your Logstash. For `bytesSent` field, you can change the data format in Kibana so that it dynamically display Bytes, KBytes, or MBytes, so there is no need for a separate kilobytesReceived

Plus I don't think you need to convert string field to integer using Logstash plugin, instead, specify data type in your ES mapping template.

---

<div class="post-metadata">

**Author:** ![gott](https://avatars.discourse-cdn.com/v4/letter/g/bbce88/32.png) [@gott](https://discuss.elastic.co/u/gott)\
**Post date:** [June 18, 2016, 7:39pm UTC](https://discuss.elastic.co/t/help-with-geolocation-please/53119/6 "2016-06-18T19:39:44Z")

</div>

Excellent I'll give it a try tomorrow and let you know. Thanks.

---

<div class="post-metadata">

**Author:** ![gott](https://avatars.discourse-cdn.com/v4/letter/g/bbce88/32.png) [@gott](https://discuss.elastic.co/u/gott)\
**Post date:** [June 18, 2016, 7:57pm UTC](https://discuss.elastic.co/t/help-with-geolocation-please/53119/7 "2016-06-18T19:57:29Z")

</div>

Thanks ash. I'll give it a try.

---

<div class="post-metadata">

**Author:** ![gott](https://avatars.discourse-cdn.com/v4/letter/g/bbce88/32.png) [@gott](https://discuss.elastic.co/u/gott)\
**Post date:** [June 20, 2016, 9:30pm UTC](https://discuss.elastic.co/t/help-with-geolocation-please/53119/8 "2016-06-20T21:30:58Z")

</div>

Well still no joy with the geo ip. I repaired the discrepancies and rebuilt the file built index.

Any other ideas guys?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:51am UTC](https://discuss.elastic.co/t/help-with-geolocation-please/53119/9 "2017-07-06T04:51:43Z")

</div>