# KIBANA geoip configuration and map

**URL:** <https://discuss.elastic.co/t/kibana-geoip-configuration-and-map/301310>\
**Category:** Kibana\
**Tags:** maps\
**Created:** [April 1, 2022, 10:32am UTC](https://discuss.elastic.co/t/kibana-geoip-configuration-and-map/301310 "2022-04-01T10:32:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Arraso26](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arraso26/32/103214_2.png) [@Arraso26](https://discuss.elastic.co/u/Arraso26)\
**Post date:** [April 1, 2022, 10:32am UTC](https://discuss.elastic.co/t/kibana-geoip-configuration-and-map/301310/1 "2022-04-01T10:32:32Z")

</div>

Good, I'm trying to visualise where the ips of the apache logs that I receive come from, but when I click on the map I get the message that I don't have the index pattern, any idea?

```auto
input {
  beats {
    port => 5044
  }
}
filter {
  grok { match => { "message" => "%{COMBINEDAPACHELOG}" } }
  geoip { source => "clientip" }
}
output {
  elasticsearch {
    hosts => ["http://192.168.14.82:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}"
  }
}

```

![geolo](https://us1.discourse-cdn.com/elastic/original/3X/a/a/aa45868a15ca5767fb4b27a21bdba94cb2abd03c.png)

 ![map](https://us1.discourse-cdn.com/elastic/original/3X/a/e/aed5ab2faf193a21c9ade32ea9de838fe9884528.png)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 1, 2022, 2:41pm UTC](https://discuss.elastic.co/t/kibana-geoip-configuration-and-map/301310/2 "2022-04-01T14:41:27Z")

</div>

What version are you on?

If older like 7.10 did you refresh the index pattern?

Go to Stack Management-\> Index pattern and refresh the pattern

Did you create a mapping with those fields?

---

<div class="post-metadata">

**Author:** ![Arraso26](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arraso26/32/103214_2.png) [@Arraso26](https://discuss.elastic.co/u/Arraso26)\
**Post date:** [April 5, 2022, 5:37am UTC](https://discuss.elastic.co/t/kibana-geoip-configuration-and-map/301310/3 "2022-04-05T05:37:11Z")

</div>

I'm on version 7.9.2 I just refreshed the index, but when I go to Maps-\>Add layer-\>Point to point when it asks me for the index it tells me that there is no option available.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 5, 2022, 3:15pm UTC](https://discuss.elastic.co/t/kibana-geoip-configuration-and-map/301310/4 "2022-04-05T15:15:30Z")

</div>

If I were you I would use the filebeat apache module directly and skip logstash it is not needed (you can use it but it is not required) The Apache module will do all the parsing and geoip etc

I would clean up everything and start over....

Basically follow these steps but use the apache module

> **[Filebeat quick start: installation and configuration | Filebeat Reference...](https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-installation-configuration.html)**

> **[Apache module | Filebeat Reference \[7.9\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-apache.html)**

Point the filebeat config directly at Elasticsearch and kibana

Once you get that working try using the "Documents" Options on the Map

If you get all that working come back and I will show you how to pass it through logstash if you still want to .

---

<div class="post-metadata">

**Author:** ![Arraso26](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arraso26/32/103214_2.png) [@Arraso26](https://discuss.elastic.co/u/Arraso26)\
**Post date:** [April 6, 2022, 5:26am UTC](https://discuss.elastic.co/t/kibana-geoip-configuration-and-map/301310/5 "2022-04-06T05:26:19Z")

</div>

thank you very much it is working

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 4, 2022, 5:26am UTC](https://discuss.elastic.co/t/kibana-geoip-configuration-and-map/301310/6 "2022-05-04T05:26:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.