# Kibana 4 and geoip

**URL:** <https://discuss.elastic.co/t/kibana-4-and-geoip/1665>\
**Category:** Kibana\
**Created:** [June 1, 2015, 9:26pm UTC](https://discuss.elastic.co/t/kibana-4-and-geoip/1665 "2015-06-01T21:26:12Z")\
**Posts on this page:** 5\
**Page:** 2

<div class="post-metadata">

**Author:** ![ctataryn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ctataryn/32/10805_2.png) [@ctataryn](https://discuss.elastic.co/u/ctataryn)\
**Post date:** [July 14, 2016, 7:47pm UTC](https://discuss.elastic.co/t/kibana-4-and-geoip/1665/21 "2016-07-14T19:47:18Z")

</div>

P.S. if this makes a difference, I was testing at first using logstash to gather and send documents directly to Elastic Search. I then switched to using filebeat to gather the files, sending them to logstash which in turn sends them to ES.

It's possible that the geoip stuff broke when I switched to using filebeat, although I'm not sure why that'd be the case! All I know is that at one point early on in my testing the geoip stuff worked fine in Kibana, now it doesn't.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 14, 2016, 8:14pm UTC](https://discuss.elastic.co/t/kibana-4-and-geoip/1665/22 "2016-07-14T20:14:49Z")

</div>

> ```
> "location": {
> 
> ```

```
        "type": "double"
      },

```

This should've said geo\_point, not double. What does your Logstash configuration look like?

---

<div class="post-metadata">

**Author:** ![ctataryn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ctataryn/32/10805_2.png) [@ctataryn](https://discuss.elastic.co/u/ctataryn)\
**Post date:** [July 14, 2016, 8:27pm UTC](https://discuss.elastic.co/t/kibana-4-and-geoip/1665/23 "2016-07-14T20:27:56Z")

</div>

Here it is (albeit spread out over different files in `conf.d`)

```
input {
  beats {
    host => "10.0.3.1"
    port => 5044
  }
}
filter {
  if [type] == "nginx_access" {
    grok {
      patterns_dir => ["/home/csapp/.logstash/patterns"]
      match => { "message" => "%{NGINXACCESS}" }
    }
    date {
      match => ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]
    }
    geoip {
      source => "clientip"
      database => "/home/csapp/.logstash/GeoLiteCity.dat"
    }
  }
}
output {
  if [type] == "nginx_access" and [response] =~ /^(5\d\d|^4\d\d)/ {
    elasticsearch {
      hosts => [" ***** :9200"]
      index => "nginx_access-%{+YYYY.MM.dd}"
      user => "admin"
      password => " *******"
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 15, 2016, 5:43am UTC](https://discuss.elastic.co/t/kibana-4-and-geoip/1665/24 "2016-07-15T05:43:28Z")

</div>

> ```
> index => "nginx_access-%{+YYYY.MM.dd}"
> 
> ```

The index template that ships with Logstash applies to logstash-\* indexes only. Since you've changed the index name to not make this you have to point Logstash to an index template that _does_ match the names of your indexes. You can just make a copy of the default template, adjust the index name pattern and configure the elasticsearch output to use your file instead.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/kibana-4-and-geoip/1665/25 "2017-07-06T13:46:32Z")

</div>

Closed on July 6, 2017, 1:46pm UTC



[Previous page](https://discuss.elastic.co/t/kibana-4-and-geoip/1665.md?page=1)