Kibana not visualizing geoip in coordinate map

Hi,
I'm having trouble visualizing my sysmon DNS logs with GeoIP resolved location on coordinate map in kibana.

Following info is being added by geoip to each log entry:

so it looks like longtitude and latitude is added, but so called destination_geo.location itself isn't there.

index mapping contains following:

    "destination" : {
      "properties" : {
        "address" : {
          "type" : "keyword",
          "ignore_above" : 1024
        },
        "bytes" : {
          "type" : "long"
        },
        "domain" : {
          "type" : "keyword",
          "ignore_above" : 1024
        },
        "geo" : {
          "properties" : {
            "city_name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "continent_name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "country_iso_code" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "country_name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "latitude" : {
              "type" : "half_float"
            },
            "location" : {
              "type" : "geo_point"
            },
            "longitude" : {
              "type" : "half_float"
            },
            "name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "region_iso_code" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "region_name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            }
          }
        },
        "ip" : {
          "type" : "ip"
        },
        "mac" : {
          "type" : "keyword",
          "ignore_above" : 1024
        },
        "packets" : {
          "type" : "long"
        },
        "port" : {
          "type" : "long"
        },
        "user" : {
          "properties" : {
            "email" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "full_name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "group" : {
              "properties" : {
                "id" : {
                  "type" : "keyword",
                  "ignore_above" : 1024
                },
                "name" : {
                  "type" : "keyword",
                  "ignore_above" : 1024
                }
              }
            },
            "hash" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "id" : {
              "type" : "keyword",
              "ignore_above" : 1024
            },
            "name" : {
              "type" : "keyword",
              "ignore_above" : 1024
            }
          }
        }
      }
    },
    "destination_geo" : {
      "properties" : {
        "city_name" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "continent_code" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "country_code2" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "country_code3" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "country_name" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "dma_code" : {
          "type" : "long"
        },
        "ip" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "latitude" : {
          "type" : "half_float"
        },
        "location" : {
          "type" : "geo_point"
        },
        "longitude" : {
          "type" : "half_float"
        },
        "postal_code" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "region_code" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "region_name" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "timezone" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
      }
    },

When I go to new visualization edit, I can only select destination.geo.location which actually wasn't created above (there was destination.geo.location.lat and *.lon). and therefore it draws nothing:

Any idea how to make it work?!

ok, do not bother reading all of it.
just fixed it by changing logstash config to target field named [destination][geo]:

    geoip {
                                            source => "[dns][resolved_ip]"
                                            target => "[destination][geo]"
                                            tag_on_failure => "_geoip_lookup_failure"
                                    }

and now it's working like a charm :wink:

1 Like

Awesome. Thanks for keeping us posted.

Cheers,
Bhavya

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.