# Kibana +geoip from ipv4 addr in a varx field **URL:** \ **Category:** Kibana\ **Created:** [December 9, 2017, 9:45pm UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944 "2017-12-09T21:45:25Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![bruno-d](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bruno-d](https://discuss.elastic.co/u/bruno-d)\ **Post date:** [December 9, 2017, 9:45pm UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/1 "2017-12-09T21:45:25Z")
Hi, i parsed syslog\_message to extract ip address from my ADSL modem to check who's ringing and store it into a new text field Varx (of my logstash index). Varx is a IPV4 text value computed every hours by an update\_by\_query POST in a cron job. The query looks into the syslog\_message string to set Varx. I developed the query in Kibana console and use the cUrl in a shell. I would like later to use a service that fill geoip structure (using free maxmind DB) by using the IPv4 stored in Varx. Last step would be to display a MAP into kibana ? My question is : I did not yet find a way to to that. Parsing all non empty VarX and set geoip.yyy to the appropriate value return by function(Varx). Any accurate tips ? thanks for the help Please note : i am completely new running ELK 5.6.4 on RPI3 ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 9, 2017, 9:53pm UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/2 "2017-12-09T21:53:52Z")
FYI we’ve renamed ELK to the Elastic Stack, otherwise Beats and APM feel left out! 😉 Can you show us examples of the `varx` field? ---
**Author:** ![bruno-d](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bruno-d](https://discuss.elastic.co/u/bruno-d)\ **Post date:** [December 10, 2017, 3:15am UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/3 "2017-12-10T03:15:09Z")
Hi, Varx are string IPV4 WAN address as 'text' like [xxx.xxx.xxx.xxx](http://xxx.xxx.xxx.xxx) Mostly it's bot who perform port scanning. One value could be Varx = _222.186.129.68_ (this one is in china 🕶) As explained, once Varx has been computed (by the update\_by\_query running each hour) i would like to compute the geoip fields from a DB or services using Varx as parameter to display a map with stats (count). thanks for any ideas. Regards ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 10, 2017, 4:45am UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/4 "2017-12-10T04:45:37Z")
You will need to reprocess the document through the geoip filter, either in Logstash or an Ingest pipeline. ---
**Author:** ![bruno-d](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bruno-d](https://discuss.elastic.co/u/bruno-d)\ **Post date:** [December 10, 2017, 6:54am UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/5 "2017-12-10T06:54:19Z")
Thanks for your answer. Could you point out the way to do it accurately ? thanks ---
**Author:** ![bruno-d](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bruno-d](https://discuss.elastic.co/u/bruno-d)\ **Post date:** [December 14, 2017, 10:48am UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/6 "2017-12-14T10:48:00Z")
hi guys, does someone can help on this product ! ---
**Author:** ![bruno-d](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bruno-d](https://discuss.elastic.co/u/bruno-d)\ **Post date:** [December 18, 2017, 9:35am UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/7 "2017-12-18T09:35:19Z")
put this thread on top of stack:joy: Still not solve 🏭🏭🏭🏭🏭 ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 18, 2017, 9:36am UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/8 "2017-12-18T09:36:45Z")
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html) explains how to do this. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 18, 2017, 9:45am UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/9 "2017-12-18T09:45:20Z")
You can do this through the [update by query API](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docs-update-by-query.html#docs-update-by-query) if you direct the data to update through an [ingest node pipeline](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/ingest.html) that uses the [ingest geoip processor plugin](https://www.elastic.co/guide/en/elasticsearch/plugins/current/ingest-geoip.html) (need to be installed separately). ---
**Author:** ![bruno-d](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bruno-d](https://discuss.elastic.co/u/bruno-d)\ **Post date:** [December 18, 2017, 9:47am UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/10 "2017-12-18T09:47:27Z")
Sorry, to bother but if the answer was easy in the doc we might not ask. From my perspective doc and info are really confusing not representative of the possibilities of the solution. Anyway, we will try to make it run. thanks i did a filter source =\> "Varx" and got a geoip failure parsing output how ever Varx is not filled at that time (empty string) . you mention that i need to reprocess once Varx is Filled but i don't know how. ---
**Author:** ![bruno-d](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bruno-d](https://discuss.elastic.co/u/bruno-d)\ **Post date:** [December 23, 2017, 11:58pm UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/11 "2017-12-23T23:58:44Z")
Hi Thanks Christian, I read your answer again and installed the pipeline geoip. Perfect (need to increase heap space to avoid crash on the PI). Then it's complicated. I tried as in the doc this PUT \_ingest/pipeline/geoip { "description" : "Add geoip info", "processors" : [ { "geoip" : { "field" : "Varx" } } ] } As **Varx** is my text field containing IP. Kibana acknoledge TRUE. { "acknowledged": true } my geoIP is still empty ? Could you help again ? Thanks and apologize for bothering 🎄 ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 24, 2017, 2:19am UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/12 "2017-12-24T02:19:32Z")
So you have stored the new pipeline. How did you use it to update documents? ---
**Author:** ![bruno-d](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bruno-d](https://discuss.elastic.co/u/bruno-d)\ **Post date:** [December 24, 2017, 4:22am UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/13 "2017-12-24T04:22:50Z")
good question 🕶 I was able to get google IP using this syntax PUT logstash-2017.12.24/syslog/\_all/?pipeline=geoip { "Varx": "8.8.8.8" } and GET logstash-2017.12.24/syslog/\_all returned { "\_index": "logstash-2017.12.24", "\_type": "syslog", "\_id": "\_all", "\_version": 2, "found": true, "\_source": { "Varx": "8.8.8.8", "geoip": { "continent\_name": "North America", "city\_name": "Mountain View", "country\_iso\_code": "US", "region\_name": "California", "location": { "lon": -122.0838, "lat": 37.386 } } } } But i don't know to process **\_all** my elements of **syslog** that have **VarX** affected Value ? Do you know how please ? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 24, 2017, 10:01am UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/14 "2017-12-24T10:01:54Z")
Have you looked at the examples in the update-by-query link I provided? ---
**Author:** ![bruno-d](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bruno-d](https://discuss.elastic.co/u/bruno-d)\ **Post date:** [December 24, 2017, 11:17am UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/15 "2017-12-24T11:17:37Z")
Hey M8 thanks to answer. I ran POST /%3Clogstash-%7Bnow%2Fd%7D%3E/syslog/\_update\_by\_query?pipeline=geoip It's start to sounds good.. but is GeoIP case sensitive '???' what should be VarX format ? Does the space at the end is an issue ? "failures": [ { "index": "logstash-2017.12.24", "type": "syslog", "id": "AWCG2d79MywR9Y3-E7vT", "cause": { "type": "exception", "reason": "java.lang.IllegalArgumentException: java.lang.IllegalArgumentException: '191.101.167.235 ' is not an IP string literal.", "caused\_by": { "type": "illegal\_argument\_exception", "reason": "java.lang.IllegalArgumentException: '191.101.167.235 ' is not an IP string literal.", "caused\_by": { "type": "illegal\_argument\_exception", "reason": "'191.101.167.235 ' is not an IP string literal." } }, PS: when default value is '0' the filter crash. so i set the default to 8.8.8.8 mostly when the syslog message is not related to intrusion i.e Varx has no real value. regards ---
**Author:** ![bruno-d](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bruno-d](https://discuss.elastic.co/u/bruno-d)\ **Post date:** [December 24, 2017, 11:32am UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/16 "2017-12-24T11:32:26Z")
looks better ---
**Author:** ![bruno-d](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@bruno-d](https://discuss.elastic.co/u/bruno-d)\ **Post date:** [December 24, 2017, 12:40pm UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/17 "2017-12-24T12:40:46Z")
Thanks work like a charm. need to trim the IP field to remove space... now it's perfect . nice job. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 21, 2018, 12:53pm UTC](https://discuss.elastic.co/t/kibana-geoip-from-ipv4-addr-in-a-varx-field/110944/18 "2018-01-21T12:53:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.