# How to use geoip logstash filter?
**URL:** https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513
**Category:** Logstash
**Created:** [July 18, 2017, 7:12am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513 "2017-07-18T07:12:25Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [July 18, 2017, 7:12am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/1 "2017-07-18T07:12:25Z")
In my log file i've lat and lon values in separate fields. I cant able to use tile map in kibana.
I have these details in my log file. Can some one guide me how to use it in to tilemap in kibana.
Thanks in advance.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 18, 2017, 7:17am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/2 "2017-07-18T07:17:08Z")
In short you have to
- make sure the mapping of your index configures a designated field as a geo\_point field (this is typically done via an index template), and
- store your lat and lon values in that field in one of the formats that ES will recognize as geo\_point (this is described in the ES documentation for geo\_point).
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [July 18, 2017, 7:20am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/3 "2017-07-18T07:20:13Z")
"geoip": {
"dynamic": "true",
"properties": {
"location": {
"type": "geo\_point"
}
this is my index template @magnusbaeck.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 18, 2017, 10:04am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/4 "2017-07-18T10:04:48Z")
What do the actual mappings of your index look like? What does an example event look like (copy/paste from Kibana's JSON tab in the Discover panel, no screenshots please)?
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [August 4, 2017, 6:50am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/5 "2017-08-04T06:50:58Z")
Do we need to download any database and place it in a specified path or kibana itself locate the lat and longi fields?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 4, 2017, 7:26am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/6 "2017-08-04T07:26:44Z")
Kibana will locate the fields by itself. Just make sure the index mappings are correct.
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [August 4, 2017, 7:28am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/7 "2017-08-04T07:28:37Z")
yeah @magnusbaeck. What about the database?
Do i need to download it from my side or its inbuilt in kibana(5.5.0).
I'm using logstash 5.5.0 too.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 4, 2017, 7:32am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/8 "2017-08-04T07:32:45Z")
What database are you talking about?
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [August 4, 2017, 7:34am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/9 "2017-08-04T07:34:19Z")
GeoLite2 database?!?!?! A city database to locate geolocation.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 4, 2017, 7:59am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/10 "2017-08-04T07:59:23Z")
As documented the geoip filter ships with a GeoIP database so you don't have to do anything about it, although the bundled database might be out of date. The documentation contains a paragraph or two about it.
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [August 4, 2017, 10:37am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/11 "2017-08-04T10:37:25Z")
"passcodeEnabled": "false",
"currentTimestamp": "2017-08-04 15:52:00.449",
"name": "Micromax-CBE",
"location": {
"latitude": "11.0130009",
"longitude": "76.9829831"
},
These are some datas that i inserted in location field. Lat and long fields as string.
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [August 4, 2017, 10:38am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/12 "2017-08-04T10:38:30Z")
but kibana does not recognise it as geopoints internally.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 4, 2017, 10:44am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/13 "2017-08-04T10:44:03Z")
According to your index template geoip.location is the name of your geo\_point field.
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [August 5, 2017, 6:58am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/14 "2017-08-05T06:58:33Z")
Yeah @magnusbaeck i did set location to geoip.location like as follows:
PUT /filebeat-\*/?pretty
{
"mappings": {
"syslog": {
"properties": {
"geoip.location": {
"type": "geo\_point"
}
}
}
}
}
and i got this error:
{
"error": {
"root\_cause": [
{
"type": "invalid\_index\_name\_exception",
"reason": "Invalid index name [filebeat-_], must not contain the following characters [, ", , \, \<, |, ,, \>, /, ?]",
"index\_uuid": "na",
"index": "filebeat-"
}
],
"type": "invalid\_index\_name\_exception",
"reason": "Invalid index name [filebeat-_], must not contain the following characters [, ", _, \, \<, |, ,, \>, /, ?]",
"index\_uuid": "na",
"index": "filebeat-_"
},
"status": 400
}
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [August 5, 2017, 7:02am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/15 "2017-08-05T07:02:18Z")
i loaded my filebeat index pattern with timestamp field, so that i dont have to create filebeat index each time(eg. if i start filebeat today it will create filebeat-2017.08.04 index and so on when i start filebeat each day) when filebeat is reading some log files from my machine.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 5, 2017, 3:26pm UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/16 "2017-08-05T15:26:08Z")
My point is: If `geoip.location` is the field you've mapped as geo\_point it's not surprising that the `location` field isn't recognized as geo\_point. If you want `location` to be a geo\_point you need to make sure _that_ field is mapped as geo\_point.
> PUT /filebeat-\*/?pretty
you're trying to create an index named, literally, filebeat-\*. That's obviously not legal and isn't want you want to do anyway.
> {
> “mappings”: {
> “syslog”: {
> “properties”: {
> “geoip.location”: {
> “type”: “geo\_point”
> }
> }
> }
> }
> }
That's not how the mapping of a nested field is set. Consult the ES documentation for details.
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [August 7, 2017, 4:06am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/17 "2017-08-07T04:06:37Z")
@magnusbaeck as you said it’s not surprising that the location field isn’t recognized as geo\_point, i do set location field as geo\_point earlier. When i referred in someother disucssion thread someone said that map location as geoip.location and it still not working well as when i had geo\_point in location field.
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [August 7, 2017, 4:12am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/18 "2017-08-07T04:12:28Z")
And also when use GET \_template/filebeat command, im getting
"filebeat": {
"order": 0,
"template": "filebeat-_",
"settings": { .....
..............
.............}}
If index pattern template name is filebeat-_, then index name must be filebeat right?
if so when i used filebeat as index name kibana throws an error like invalid index name .
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 7, 2017, 5:19am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/19 "2017-08-07T05:19:54Z")
> i do set location field as geo\_point earlier.
What do the actual mappings of the index look like? Use the get mapping API.
> If index pattern template name is `filebeat-*`, then index name must be filebeat right?
It must begin with "filebeat-", yes, but anything can follow after that. It's a wildcard pattern.
---
### Author:  [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)
#### Post date: [August 7, 2017, 6:00am UTC](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513/20 "2017-08-07T06:00:55Z")
I tried get mapping api in 2 different ways.
1. GET filebeat/\_mapping and it throws an error:
{
"error": {
"root\_cause": [
{
"type": "index\_not\_found\_exception",
"reason": "no such index",
"resource.type": "index\_or\_alias",
"[resource.id](http://resource.id)": "filebeat",
"index\_uuid": "_na_",
"index": "filebeat"
}
],
"type": "index\_not\_found\_exception",
"reason": "no such index",
"resource.type": "index\_or\_alias",
"[resource.id](http://resource.id)": "filebeat",
"index\_uuid": "_na_",
"index": "filebeat"
},
"status": 404
}
1. GET filebeat-\*/\_mapping and it shows nothing than {}.
[Next page](https://discuss.elastic.co/t/how-to-use-geoip-logstash-filter/93513.md?page=2)