# How to rightly use geoip filter & get latitude & longitude to visualize in Map

**URL:** <https://discuss.elastic.co/t/how-to-rightly-use-geoip-filter-get-latitude-longitude-to-visualize-in-map/190665>\
**Category:** Logstash\
**Created:** [July 16, 2019, 7:38am UTC](https://discuss.elastic.co/t/how-to-rightly-use-geoip-filter-get-latitude-longitude-to-visualize-in-map/190665 "2019-07-16T07:38:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![madhan8](https://avatars.discourse-cdn.com/v4/letter/m/898d66/32.png) [@madhan8](https://discuss.elastic.co/u/madhan8)\
**Post date:** [July 16, 2019, 7:38am UTC](https://discuss.elastic.co/t/how-to-rightly-use-geoip-filter-get-latitude-longitude-to-visualize-in-map/190665/1 "2019-07-16T07:38:21Z")

</div>

Hello Guys,

I have geoip plugin installed in elasticsearch and I have used the below logstash config -

if "ng" in [tags] {  
grok {  
match =\> {  
"message" =\> "%{IP:service\_ip} - - [%{HTTPDATE:service\_timestamp}] "%{WORD:service\_method} /%{NOTSPACE:service\_request\_page} %{WORD:service\_request}/%{NUMBER:service\_http\_version}" %{NUMBER:service\_server\_response}"  
}  
}  
geoip {source =\> "service\_ip"}  
}

But the events are not getting any of the geoip fields and are tagged under \_geoip\_lookup\_failure.

You help is required here!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 16, 2019, 11:59am UTC](https://discuss.elastic.co/t/how-to-rightly-use-geoip-filter-get-latitude-longitude-to-visualize-in-map/190665/2 "2019-07-16T11:59:46Z")

</div>

Can you give an example of an IP that gets that failure tag?

---

<div class="post-metadata">

**Author:** ![madhan8](https://avatars.discourse-cdn.com/v4/letter/m/898d66/32.png) [@madhan8](https://discuss.elastic.co/u/madhan8)\
**Post date:** [July 17, 2019, 6:09am UTC](https://discuss.elastic.co/t/how-to-rightly-use-geoip-filter-get-latitude-longitude-to-visualize-in-map/190665/3 "2019-07-17T06:09:01Z")

</div>

Hi Badger, Its 10.6 series! It is container networking IP within a tenant

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 17, 2019, 1:38pm UTC](https://discuss.elastic.co/t/how-to-rightly-use-geoip-filter-get-latitude-longitude-to-visualize-in-map/190665/4 "2019-07-17T13:38:45Z")

</div>

10/8, like 192.168/16, is a reserved network. It has different locations for different people. For me, 192.168.1.1 is a wireless hub across the room from me. That is probably true for millions of people, so every one of those people would need a different geoip database to resolve the location of reserved networks. This is why you get a lookup failure for reserved networks with the default database.

It would be possible to build your own custom database for the reserved networks you have to deal with.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2019, 1:39pm UTC](https://discuss.elastic.co/t/how-to-rightly-use-geoip-filter-get-latitude-longitude-to-visualize-in-map/190665/5 "2019-08-14T13:39:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.