# How to configure ELK for geoip

**URL:** <https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590>\
**Category:** Elasticsearch\
**Created:** [November 18, 2021, 1:08pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590 "2021-11-18T13:08:54Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![root\_linux](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@root\_linux](https://discuss.elastic.co/u/root_linux)\
**Post date:** [November 18, 2021, 1:08pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/1 "2021-11-18T13:08:54Z")

</div>

Hi,  
I want to configure ELK stack. Elasticsearch, Kibana and Logstash will configure at one server and there will be multiple filebeat client. How can I configure for geoip? What need to configure in Elasticsearch, Kibana and Logstash for the same? I am beginner in ELK, please guide me.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 18, 2021, 2:11pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/2 "2021-11-18T14:11:24Z")

</div>

I'm not sure. What do you mean by "How can I configure for geoip?".

What do you want to do exactly? What kind of data you want to collect?

---

<div class="post-metadata">

**Author:** ![root\_linux](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@root\_linux](https://discuss.elastic.co/u/root_linux)\
**Post date:** [November 18, 2021, 3:44pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/3 "2021-11-18T15:44:05Z")

</div>

@dadoonet , thanks for your response.  
I want to visualize IP on map in kibana visualization. For that what will be configuration in Elasticsearch, logstash and filebeat.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 18, 2021, 8:54pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/4 "2021-11-18T20:54:13Z")

</div>

IP comes from?

---

<div class="post-metadata">

**Author:** ![root\_linux](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@root\_linux](https://discuss.elastic.co/u/root_linux)\
**Post date:** [November 19, 2021, 5:56am UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/5 "2021-11-19T05:56:04Z")

</div>

Logs will come from filebeat client which will contain public IP, to logstash. Then I want to visualize these IPs in kibana. Here is the sample log:

```auto
SID [183733] Send Length [15595] through PROTOCOL_PSEUDO_SSL_SOCKET to [/173.98.56.1:40606]

```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 19, 2021, 8:50am UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/6 "2021-11-19T08:50:33Z")

</div>

Is that a known/standard log format or something which is built internally?

---

<div class="post-metadata">

**Author:** ![root\_linux](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@root\_linux](https://discuss.elastic.co/u/root_linux)\
**Post date:** [November 19, 2021, 8:52am UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/7 "2021-11-19T08:52:54Z")

</div>

It is built internally.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 19, 2021, 9:07am UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/8 "2021-11-19T09:07:56Z")

</div>

So the first step is to ask filebeat to collect each line of your logs. And send to Elasticsearch.  
Did you do that yet?

---

<div class="post-metadata">

**Author:** ![root\_linux](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@root\_linux](https://discuss.elastic.co/u/root_linux)\
**Post date:** [November 19, 2021, 9:20am UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/9 "2021-11-19T09:20:51Z")

</div>

yes, have done it.

---

<div class="post-metadata">

**Author:** ![root\_linux](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@root\_linux](https://discuss.elastic.co/u/root_linux)\
**Post date:** [November 19, 2021, 9:22am UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/10 "2021-11-19T09:22:51Z")

</div>

I have sent logs from filebeat to logstash

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 19, 2021, 10:40am UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/11 "2021-11-19T10:40:01Z")

</div>

I don't think you need Logstash for a simple use case like this.  
So send directly to Elasticsearch.

You can use [this option](https://www.elastic.co/guide/en/beats/filebeat/current/dissect.html) in filebeat to dissect the content of the log line.

But I'd recommend creating an ingest pipeline in Elasticsearch and use the [Dissect processor | Elasticsearch Guide [7.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/dissect-processor.html)

Then, once you have extracted the IP address in a field, you can apply a [GeoIP processor | Elasticsearch Guide [7.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/geoip-processor.html)

Let me know when it's done.

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [November 20, 2021, 12:29pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/13 "2021-11-20T12:29:41Z")

</div>

You will need to define field `geoip.location` as type of `geo_point` in your index mapping before ingestion

---

<div class="post-metadata">

**Author:** ![root\_linux](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@root\_linux](https://discuss.elastic.co/u/root_linux)\
**Post date:** [November 20, 2021, 1:10pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/14 "2021-11-20T13:10:07Z")

</div>

@ylasri thanks for your response.  
Could you guide me how can I do that ( define field `geoip.location` as type of `geo_point` in your index mapping before ingestion)? Because I am beginner.  
Thanks in advance.

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [November 20, 2021, 1:47pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/15 "2021-11-20T13:47:33Z")

</div>

Something like this to define an index template

```auto
PUT _template/filebeat-geoip
{
  "index_patterns": [
    "filebeat*"
  ],
  "mappings": {
    "properties": {
      "geoip": {
        "properties": {
          "location": {
            "type": "geo_point"
          },
          "ip": {
            "type": "ip"
          }
        }
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [November 20, 2021, 1:48pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/16 "2021-11-20T13:48:06Z")

</div>

> **[Geopoint field type | Elasticsearch Guide \[7.15\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html)**

---

<div class="post-metadata">

**Author:** ![root\_linux](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@root\_linux](https://discuss.elastic.co/u/root_linux)\
**Post date:** [November 20, 2021, 4:04pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/18 "2021-11-20T16:04:24Z")

</div>

I was gettiing this error in Chrome browser but it is working fine in Firefox. Thank you so much @ylasri and @dadoonet for your support

---

<div class="post-metadata">

**Author:** ![root\_linux](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@root\_linux](https://discuss.elastic.co/u/root_linux)\
**Post date:** [November 20, 2021, 4:07pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/19 "2021-11-20T16:07:37Z")

</div>

I have another query. Suppose if I want to get ISP for that IP then, is there any way to do that?

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [November 20, 2021, 5:01pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/20 "2021-11-20T17:01:56Z")

</div>

> **[Geoip filter plugin | Logstash Reference \[7.15\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-default_database_type)**

---

<div class="post-metadata">

**Author:** ![root\_linux](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@root\_linux](https://discuss.elastic.co/u/root_linux)\
**Post date:** [November 20, 2021, 6:21pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/21 "2021-11-20T18:21:31Z")

</div>

Hi @ylasri , should I have to pay to get to know ISP?

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [November 20, 2021, 6:35pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590/22 "2021-11-20T18:35:59Z")

</div>

No,  
You can use geoip filter twice  
First time with default value of default\_database\_type to get Lat/Lon  
Second with the default\_database\_type to ASN ti get ISP ASN

[Next page](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590.md?page=2)