Kibana not visualizing geoip in coordinate map

Elastic Stack Kibana
1

Hi,
I'm having trouble visualizing my sysmon DNS logs with GeoIP resolved location on coordinate map in kibana.

Following info is being added by geoip to each log entry:

logs_fields
logs_fields678×762 34 KB

so it looks like longtitude and latitude is added, but so called destination_geo.location itself isn't there.

index mapping contains following:

    "destination" : {
      "properties" : {
        "address" : {
          "type" : "keyword",
          "ignore_above" : 1024
        },
        "bytes" : {
          "type" : "long"
        },
        "domain" : {
          "type" : "keyword",
          "ignore_above" : 1024
        },
        "geo" : {
          "properties" : {
            "city_name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "continent_name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "country_iso_code" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "country_name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "latitude" : {
              "type" : "half_float"
            },
            "location" : {
              "type" : "geo_point"
            },
            "longitude" : {
              "type" : "half_float"
            },
            "name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "region_iso_code" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "region_name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            }
          }
        },
        "ip" : {
          "type" : "ip"
        },
        "mac" : {
          "type" : "keyword",
          "ignore_above" : 1024
        },
        "packets" : {
          "type" : "long"
        },
        "port" : {
          "type" : "long"
        },
        "user" : {
          "properties" : {
            "email" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "full_name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "group" : {
              "properties" : {
                "id" : {
                  "type" : "keyword",
                  "ignore_above" : 1024
                },
                "name" : {
                  "type" : "keyword",
                  "ignore_above" : 1024
                }
              }
            },
            "hash" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "id" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            }
          }
        }
      }
    },
    "destination_geo" : {
      "properties" : {
        "city_name" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "continent_code" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "country_code2" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "country_code3" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "country_name" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "dma_code" : {
          "type" : "long"
        },
        "ip" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "latitude" : {
          "type" : "half_float"
        },
        "location" : {
          "type" : "geo_point"
        },
        "longitude" : {
          "type" : "half_float"
        },
        "postal_code" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "region_code" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "region_name" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "timezone" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
      }
    },

When I go to new visualization edit, I can only select destination.geo.location which actually wasn't created above (there was destination.geo.location.lat and *.lon). and therefore it draws nothing:

coordinate_map
coordinate_map1645×746 164 KB

Any idea how to make it work?!

2

ok, do not bother reading all of it.
just fixed it by changing logstash config to target field named [destination][geo]:

    geoip {
                                            source => "[dns][resolved_ip]"
                                            target => "[destination][geo]"
                                            tag_on_failure => "_geoip_lookup_failure"
                                    }

and now it's working like a charm :wink:

1 Like
3

Awesome. Thanks for keeping us posted.

Cheers,
Bhavya

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.