# How to get geo.src and geo.dest fields while creating Sankey Chart

**URL:** https://discuss.elastic.co/t/how-to-get-geo-src-and-geo-dest-fields-while-creating-sankey-chart/182801
**Category:** Kibana
**Created:** [May 26, 2019, 2:53pm UTC](https://discuss.elastic.co/t/how-to-get-geo-src-and-geo-dest-fields-while-creating-sankey-chart/182801 "2019-05-26T14:53:27Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Pankaj\_Navneet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pankaj_navneet/32/42419_2.png) [@Pankaj\_Navneet](https://discuss.elastic.co/u/Pankaj_Navneet)
#### Post date: [May 26, 2019, 2:53pm UTC](https://discuss.elastic.co/t/how-to-get-geo-src-and-geo-dest-fields-while-creating-sankey-chart/182801/1 "2019-05-26T14:53:27Z")

</div>

Hi,

Can somebody help me in knowing how to get the **geo.src & geo.dest** fields in Sankey Chart creation? I am trying to parse the Apache logs but I want to have Source IP + Destination IP to view the traffic. or you can say that **Source Country & Destination** Country names.

Using " **kibana\_sample\_data\_logs**" as an **INDEX** pattern we are getting these fields. SO what if I want to parse my own Apache logs, then why these fields are not showing there.? Which are required fields to populate the Sankey Chart.

Regards,  
Puneet

---

<div class="post-metadata">

### Author: ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)
#### Post date: [May 27, 2019, 9:01pm UTC](https://discuss.elastic.co/t/how-to-get-geo-src-and-geo-dest-fields-while-creating-sankey-chart/182801/2 "2019-05-27T21:01:24Z")

</div>

Hi,

Are you indexing apache logs into Elasticsearch, created an index pattern in kibana for it and does the indexpattern have geo.src and geo.dest fields?

Kibana sample data logs has those fields indexed into elasticsearch. That's why we were able to create the visualization in sankey chart.

Also if you can run filebeat - it has apache module: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-apache.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-apache.html). It also comes with well built dashboards.

Thanks.  
Bhavya

---

<div class="post-metadata">

### Author: ![Pankaj\_Navneet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pankaj_navneet/32/42419_2.png) [@Pankaj\_Navneet](https://discuss.elastic.co/u/Pankaj_Navneet)
#### Post date: [May 28, 2019, 11:53am UTC](https://discuss.elastic.co/t/how-to-get-geo-src-and-geo-dest-fields-while-creating-sankey-chart/182801/3 "2019-05-28T11:53:13Z")

</div>

No, i don't want to use the built-in sample logs for this purpose. I want to use my own apache logs for creating Sankey Charts. I want to know how to get these fields geo.src and geo.dest in the logs after parsing.

Thanks  
Puneet T

---

<div class="post-metadata">

### Author: ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)
#### Post date: [May 28, 2019, 12:31pm UTC](https://discuss.elastic.co/t/how-to-get-geo-src-and-geo-dest-fields-while-creating-sankey-chart/182801/4 "2019-05-28T12:31:56Z")

</div>

Hi,

So kibana cannot insert any fields into documents. You can only do it when you are ingesting documents into elasticsearch.

Can you check if you those fields in your data and have you created the mapping correctly?

Thanks,  
Bhavya

---

<div class="post-metadata">

### Author: ![Pankaj\_Navneet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pankaj_navneet/32/42419_2.png) [@Pankaj\_Navneet](https://discuss.elastic.co/u/Pankaj_Navneet)
#### Post date: [May 28, 2019, 6:19pm UTC](https://discuss.elastic.co/t/how-to-get-geo-src-and-geo-dest-fields-while-creating-sankey-chart/182801/5 "2019-05-28T18:19:50Z")

</div>

Hi,

I only have Source Ip in my logs with other normal information that an apache log have. Can you please help me in knowing how to ingest source-destination documents or geo.src & geo.dest fields in the apache logs?

Regards,  
Puneet T

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 25, 2019, 6:19pm UTC](https://discuss.elastic.co/t/how-to-get-geo-src-and-geo-dest-fields-while-creating-sankey-chart/182801/6 "2019-06-25T18:19:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
