# Kibana not visualizing geoip in coordinate map

**URL:** <https://discuss.elastic.co/t/kibana-not-visualizing-geoip-in-coordinate-map/204635>\
**Category:** Kibana\
**Created:** [October 22, 2019, 11:13am UTC](https://discuss.elastic.co/t/kibana-not-visualizing-geoip-in-coordinate-map/204635 "2019-10-22T11:13:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![aimarjg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aimarjg/32/50430_2.png) [@aimarjg](https://discuss.elastic.co/u/aimarjg)\
**Post date:** [October 22, 2019, 11:13am UTC](https://discuss.elastic.co/t/kibana-not-visualizing-geoip-in-coordinate-map/204635/1 "2019-10-22T11:13:33Z")

</div>

Hi,  
I'm having trouble visualizing my sysmon DNS logs with GeoIP resolved location on coordinate map in kibana.

Following info is being added by geoip to each log entry:

 ![logs_fields](https://us1.discourse-cdn.com/elastic/original/3X/6/c/6c56409031e9388e9f36fee5e9c7458007dc8d74.png)

so it looks like longtitude and latitude is added, but so called destination\_geo.location itself isn't there.

index mapping contains following:

> ```
> "destination" : {
> "properties" : {
> "address" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "bytes" : {
> "type" : "long"
> },
> "domain" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "geo" : {
> "properties" : {
> "city_name" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "continent_name" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "country_iso_code" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "country_name" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "latitude" : {
> "type" : "half_float"
> },
> "location" : {
> "type" : "geo_point"
> },
> "longitude" : {
> "type" : "half_float"
> },
> "name" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "region_iso_code" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "region_name" : {
> "type" : "keyword",
> "ignore_above" : 1024
> }
> }
> },
> "ip" : {
> "type" : "ip"
> },
> "mac" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "packets" : {
> "type" : "long"
> },
> "port" : {
> "type" : "long"
> },
> "user" : {
> "properties" : {
> "email" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "full_name" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "group" : {
> "properties" : {
> "id" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "name" : {
> "type" : "keyword",
> "ignore_above" : 1024
> }
> }
> },
> "hash" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "id" : {
> "type" : "keyword",
> "ignore_above" : 1024
> },
> "name" : {
> "type" : "keyword",
> "ignore_above" : 1024
> }
> }
> }
> }
> },
> "destination_geo" : {
> "properties" : {
> "city_name" : {
> "type" : "text",
> "fields" : {
> "keyword" : {
> "type" : "keyword",
> "ignore_above" : 256
> }
> }
> },
> "continent_code" : {
> "type" : "text",
> "fields" : {
> "keyword" : {
> "type" : "keyword",
> "ignore_above" : 256
> }
> }
> },
> "country_code2" : {
> "type" : "text",
> "fields" : {
> "keyword" : {
> "type" : "keyword",
> "ignore_above" : 256
> }
> }
> },
> "country_code3" : {
> "type" : "text",
> "fields" : {
> "keyword" : {
> "type" : "keyword",
> "ignore_above" : 256
> }
> }
> },
> "country_name" : {
> "type" : "text",
> "fields" : {
> "keyword" : {
> "type" : "keyword",
> "ignore_above" : 256
> }
> }
> },
> "dma_code" : {
> "type" : "long"
> },
> "ip" : {
> "type" : "text",
> "fields" : {
> "keyword" : {
> "type" : "keyword",
> "ignore_above" : 256
> }
> }
> },
> "latitude" : {
> "type" : "half_float"
> },
> "location" : {
> "type" : "geo_point"
> },
> "longitude" : {
> "type" : "half_float"
> },
> "postal_code" : {
> "type" : "text",
> "fields" : {
> "keyword" : {
> "type" : "keyword",
> "ignore_above" : 256
> }
> }
> },
> "region_code" : {
> "type" : "text",
> "fields" : {
> "keyword" : {
> "type" : "keyword",
> "ignore_above" : 256
> }
> }
> },
> "region_name" : {
> "type" : "text",
> "fields" : {
> "keyword" : {
> "type" : "keyword",
> "ignore_above" : 256
> }
> }
> },
> "timezone" : {
> "type" : "text",
> "fields" : {
> "keyword" : {
> "type" : "keyword",
> "ignore_above" : 256
> }
> }
> }
> }
> },
> 
> ```

When I go to new visualization edit, I can only select destination.geo.location which actually wasn't created above (there was destination.geo.location.lat and \*.lon). and therefore it draws nothing:

 ![coordinate_map](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a182fe4bcef76dccf8c4987b965df1db320660f4.png)

Any idea how to make it work?!

---

<div class="post-metadata">

**Author:** ![aimarjg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aimarjg/32/50430_2.png) [@aimarjg](https://discuss.elastic.co/u/aimarjg)\
**Post date:** [October 22, 2019, 11:27am UTC](https://discuss.elastic.co/t/kibana-not-visualizing-geoip-in-coordinate-map/204635/2 "2019-10-22T11:27:50Z")

</div>

ok, do not bother reading all of it.  
just fixed it by changing logstash config to target field named [destination][geo]:

> ```
> geoip {
> source => "[dns][resolved_ip]"
> target => "[destination][geo]"
> tag_on_failure => "_geoip_lookup_failure"
> }
> 
> ```

and now it's working like a charm 😉

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [October 22, 2019, 1:41pm UTC](https://discuss.elastic.co/t/kibana-not-visualizing-geoip-in-coordinate-map/204635/3 "2019-10-22T13:41:18Z")

</div>

Awesome. Thanks for keeping us posted.

Cheers,  
Bhavya

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 19, 2019, 1:41pm UTC](https://discuss.elastic.co/t/kibana-not-visualizing-geoip-in-coordinate-map/204635/4 "2019-11-19T13:41:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.