# How to setup logstash with geoip
**URL:** https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078
**Category:** Logstash
**Created:** [January 18, 2017, 8:07pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078 "2017-01-18T20:07:19Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [January 18, 2017, 8:07pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/1 "2017-01-18T20:07:19Z")
I want to enable this
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 22, 2017, 1:34pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/2 "2017-01-22T13:34:18Z")
Please explain better what you're trying to achieve and what you have so far. What does your data look like, for example?
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [January 22, 2017, 7:29pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/3 "2017-01-22T19:29:12Z")
Hi Magnus
I am collecting my DNS log and i am able to do so with packetbeat sending dns logs to the elk stack. All i want to do now is to add the geographical data for clients query to my dns server.
I can share with you my Kibana Webinterface if that will help provide more detail as i am new to this.
FYI
I just heard ELK Stack from somene else and google everything and am able to put things together just last week after 3 weeks of searching ... woohoo !!! i made it ...
Anyway the point is i am new and not a programmer but hopefully i will be able to get the most out of this Wonderfull Appliation.
Hope to hear you soon.
Maile.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 22, 2017, 8:06pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/4 "2017-01-22T20:06:14Z")
If you're sending Packetbeat data via Logstash, use the geoip filter plugin to turn IP addresses into latitude/longitude values. If you're sending Packetbeat data directly to Elasticsearch (and you're using ES 5.0 or later) use the GeoIP ingest processor.
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [January 22, 2017, 8:19pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/5 "2017-01-22T20:19:10Z")
Yes I am using ES 5.1 .... Could you suggest a link or hint for proposed method above ....
Thanks in advance ..
Maile.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 22, 2017, 8:33pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/6 "2017-01-22T20:33:54Z")
Which of the methods? I briefly described two of them.
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [January 22, 2017, 8:54pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/7 "2017-01-22T20:54:58Z")
I guess it is the first i am using as Output Logstash set on my packetbeat config .....
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [January 22, 2017, 9:15pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/8 "2017-01-22T21:15:28Z")
> [@magnusbaeck](#):
>
> use the geoip filter plugin to turn IP addresses into latitude/longitude values
Do you think this is what i am looking for ???
> **[Enrich events with geoIP information | Packetbeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-geoip.html)**
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [January 22, 2017, 9:41pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/9 "2017-01-22T21:41:06Z")
on this link i send above where i can out step number 2 ........
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [January 22, 2017, 11:28pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/10 "2017-01-22T23:28:34Z")
should i change anything on logstash config ???
appreciate your kind reply.
thanks
Maile.
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [January 23, 2017, 1:00am UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/11 "2017-01-23T01:00:32Z")
anybody here ???
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [January 23, 2017, 1:07am UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/12 "2017-01-23T01:07:06Z")
Hi Magnus
Can you reply to my email above ...
Thanks.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 23, 2017, 6:42am UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/13 "2017-01-23T06:42:26Z")
> I guess it is the first i am using as Output Logstash set on my packetbeat config .....
Then add a [geoip filter](https://www.elastic.co/guide/en/logstash/5.1/plugins-filters-geoip.html) to your Logstash configuration and point it at the field where you have the IP address you want to visualize, e.g. like this:
```plaintext
filter {
geoip {
source => "name-of-ip-address-field"
}
}
```
> Can you reply to my email above ...
Do you really expect me to respond to your questions at 21:30 on a Sunday night?
---
### Author:  [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)
#### Post date: [January 24, 2017, 9:01am UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/14 "2017-01-24T09:01:50Z")
?Sorry Magnus
Appreciate your kind reply.
Will send you more mail tommorrow as i was away today.
Regards
Maile.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2017, 9:02am UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078/15 "2017-02-21T09:02:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.