# Issues with geoip data logstash and filebeat using iis logs

**URL:** <https://discuss.elastic.co/t/issues-with-geoip-data-logstash-and-filebeat-using-iis-logs/236933>\
**Category:** Logstash\
**Created:** [June 12, 2020, 6:43pm UTC](https://discuss.elastic.co/t/issues-with-geoip-data-logstash-and-filebeat-using-iis-logs/236933 "2020-06-12T18:43:22Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![genehunter29009](https://avatars.discourse-cdn.com/v4/letter/g/45deac/32.png) [@genehunter29009](https://discuss.elastic.co/u/genehunter29009)\
**Post date:** [June 12, 2020, 6:43pm UTC](https://discuss.elastic.co/t/issues-with-geoip-data-logstash-and-filebeat-using-iis-logs/236933/1 "2020-06-12T18:43:22Z")

</div>

Having a hard time getting geoip to work. I have the latest current verion of filebeat and logstash.  
filebeat 7.7.7  
template is loaded.

one strange thing also I get like 6 ip addresses when I use geoip but nothing else seems to work.  
also 6 different mac addresses.

filter {

if [agent][type] == "filebeat" {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:log\_timestamp} %{WORD:sitename} %{WORD:host-hostname} %{IPORHOST:host-ip} %{WORD:method} %{URIPATH:page} %{NOTSPACE:querystring} %{NUMBER:host-port} %{NOTSPACE:username} %{IPORHOST:client-ip} %{NOTSPACE:client-version} %{NOTSPACE:useragent} %{NOTSPACE:cs-cookie} (-|%{URI:cs\_refrer}) %{NOTSPACE:cs-host} %{NUMBER:sc-status} %{NUMBER:sc-sub-status} %{NUMBER:win32-status} %{NUMBER:sc-bytes} %{NUMBER:cs-bytes} %{NUMBER:duration} %{IPORHOST:forwarder-ip}"}  
}  
date {  
match =\> ["log\_timestamp", "yyyy-MM-dd HH:mm:ss"]  
}  
mutate {  
convert =\> {  
"cs-bytes" =\> "integer"  
"duration" =\> "integer"  
"host-port" =\> "integer"  
"sc-bytes" =\> "integer"  
"sc-status" =\> "integer"  
"sc-sub-status" =\> "integer"  
"win32-status" =\> "integer"  
}  
remove\_field =\> "message"  
}  
geoip { source =\> ["client-ip"] }  
}}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 12, 2020, 7:22pm UTC](https://discuss.elastic.co/t/issues-with-geoip-data-logstash-and-filebeat-using-iis-logs/236933/2 "2020-06-12T19:22:04Z")

</div>

What is your question?

---

<div class="post-metadata">

**Author:** ![genehunter29009](https://avatars.discourse-cdn.com/v4/letter/g/45deac/32.png) [@genehunter29009](https://discuss.elastic.co/u/genehunter29009)\
**Post date:** [June 13, 2020, 2:39pm UTC](https://discuss.elastic.co/t/issues-with-geoip-data-logstash-and-filebeat-using-iis-logs/236933/3 "2020-06-13T14:39:57Z")

</div>

> [@genehunter29009](#):
>
> geoip to work. I have the latest current verion of filebeat and logstash.  
> filebeat 7.7.7  
> template is loaded.
> 
> one strange thing also I get like 6 ip addresses when I use geoip but nothing else seems to work.  
> also 6 different mac addresses.

I cant figure out why it is not working, The error in tags just says geoipparsefailure

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 13, 2020, 2:47pm UTC](https://discuss.elastic.co/t/issues-with-geoip-data-logstash-and-filebeat-using-iis-logs/236933/4 "2020-06-13T14:47:07Z")

</div>

If you are getting a \_geoip\_lookup\_failure tag then enable log.level debug. @geoipfilter.handleEvent may then log what exception it caught.

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [June 14, 2020, 3:24am UTC](https://discuss.elastic.co/t/issues-with-geoip-data-logstash-and-filebeat-using-iis-logs/236933/5 "2020-06-14T03:24:43Z")

</div>

> [@genehunter29009](#):
>
> geoip { source =\> ["client-ip"] }

either use [client-ip] or “client-ip”

---

<div class="post-metadata">

**Author:** ![genehunter29009](https://avatars.discourse-cdn.com/v4/letter/g/45deac/32.png) [@genehunter29009](https://discuss.elastic.co/u/genehunter29009)\
**Post date:** [June 15, 2020, 1:40pm UTC](https://discuss.elastic.co/t/issues-with-geoip-data-logstash-and-filebeat-using-iis-logs/236933/6 "2020-06-15T13:40:09Z")

</div>

> [@Badger](#):
>
> enable log.level debug

My issue appears to be that I have multiple ip addresses showing up in the ip field. I am getting ipv4 and ipv6.

---

<div class="post-metadata">

**Author:** ![genehunter29009](https://avatars.discourse-cdn.com/v4/letter/g/45deac/32.png) [@genehunter29009](https://discuss.elastic.co/u/genehunter29009)\
**Post date:** [June 16, 2020, 11:57am UTC](https://discuss.elastic.co/t/issues-with-geoip-data-logstash-and-filebeat-using-iis-logs/236933/7 "2020-06-16T11:57:56Z")

</div>

I found my issue, first rule is know your data. I needed to get the XFORWARDED ip instead of client-ip

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 14, 2020, 11:57am UTC](https://discuss.elastic.co/t/issues-with-geoip-data-logstash-and-filebeat-using-iis-logs/236933/8 "2020-07-14T11:57:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.