# Kibana DMARC IP location

**URL:** <https://discuss.elastic.co/t/kibana-dmarc-ip-location/282574>\
**Category:** Kibana\
**Created:** [August 26, 2021, 12:24pm UTC](https://discuss.elastic.co/t/kibana-dmarc-ip-location/282574 "2021-08-26T12:24:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![hapkoek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hapkoek/32/93757_2.png) [@hapkoek](https://discuss.elastic.co/u/hapkoek)\
**Post date:** [August 26, 2021, 12:24pm UTC](https://discuss.elastic.co/t/kibana-dmarc-ip-location/282574/1 "2021-08-26T12:24:55Z")

</div>

Hi all,

Recently I installed Elastic and Kibana to create a [dashboard for DMARC statistics.](https://www.linuxbabe.com/mail-server/parsedmarc-ubuntu-18-04-16-04) (ParseDMARC)

Currently Kibana uses ParseDMARC objects to import the data. Two of the fields are Source\_IP and Destination\_IP. I'd like to convert these objects to locations so I can visualize these on a map. I read that GeoIP is included in Elastic, but I'm not sure how to connect ParseDMARC data to GeoIP and import it into Kibana.

Has anyone done this before and if so, is there a guide on how to do this?

Kind regards,  
Hapkoek

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 30, 2021, 12:05am UTC](https://discuss.elastic.co/t/kibana-dmarc-ip-location/282574/2 "2021-08-30T00:05:20Z")

</div>

Welcome to our community! 😃

Did you see this part of the instructions you linked?

> ParseDMARC will need to download MaxMind GeoIP database to `/usr/share/elasticsearch/modules/ingest-geoip` directory, so the `parsedmarc` user needs to have write permission.

---

<div class="post-metadata">

**Author:** ![hapkoek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hapkoek/32/93757_2.png) [@hapkoek](https://discuss.elastic.co/u/hapkoek)\
**Post date:** [September 1, 2021, 9:22am UTC](https://discuss.elastic.co/t/kibana-dmarc-ip-location/282574/3 "2021-09-01T09:22:38Z")

</div>

First of all, thanks for welcoming me!

I must've missed that part.. I'll have a look at that! So after giving write permission to the directory I should be able to translate IP's to locations in the kibana dashboard? I'm not sure how or where to do this..

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 2, 2021, 4:41am UTC](https://discuss.elastic.co/t/kibana-dmarc-ip-location/282574/4 "2021-09-02T04:41:31Z")

</div>

According to the instructions, if you run that command it'll download the geoip database it needs, then when you restart the process it'll start to do the geolocation.

It won't apply to historic data though.

---

<div class="post-metadata">

**Author:** ![hapkoek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hapkoek/32/93757_2.png) [@hapkoek](https://discuss.elastic.co/u/hapkoek)\
**Post date:** [September 9, 2021, 8:10am UTC](https://discuss.elastic.co/t/kibana-dmarc-ip-location/282574/5 "2021-09-09T08:10:04Z")

</div>

Sorry for the late response, I used the command u posted and tried to add the data in Kibana. I have the following options:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/c/6c8d12aaf2a4a9c826580e2954b9a9d2c0331924.png)  
But if I click one i get this message:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/6/960c025c9be4b8d7e74bd15e292b4273ef330bf1.png)

Do you have any tips on what I can check to troubleshoot this issue?  
Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 7, 2021, 8:10am UTC](https://discuss.elastic.co/t/kibana-dmarc-ip-location/282574/6 "2021-10-07T08:10:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
