# Kibana SIEM application is not displaying proper AS and GeoIP fields

**URL:** <https://discuss.elastic.co/t/kibana-siem-application-is-not-displaying-proper-as-and-geoip-fields/223972>\
**Category:** SIEM\
**Created:** [March 17, 2020, 4:23pm UTC](https://discuss.elastic.co/t/kibana-siem-application-is-not-displaying-proper-as-and-geoip-fields/223972 "2020-03-17T16:23:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gmexican14](https://avatars.discourse-cdn.com/v4/letter/g/edb3f5/32.png) [@Gmexican14](https://discuss.elastic.co/u/Gmexican14)\
**Post date:** [March 17, 2020, 4:23pm UTC](https://discuss.elastic.co/t/kibana-siem-application-is-not-displaying-proper-as-and-geoip-fields/223972/1 "2020-03-17T16:23:00Z")

</div>

Hello everyone,

I am having an issue when it comes to displaying GeoIP fields and AS fields in the SIEM app within Kibana.

I have made sure that the fields get remapped to the appropriate ECS fields. As seen in the screenshot there is no field populated, but when I inspect and view the response gathered, I can see that the information is populated but just not displayed.

I am using logstash to rename, remap the fields and add GeoIP data. I can share that configuration if needed.

I appreciate the help and anyone giving any advice.

**Response Data**

```auto
  {
   "took": 4,
   "timed_out": false,
   "_shards": {
     "total": 5,
     "successful": 5,
     "skipped": 0,
     "failed": 0
   },
   "hits": {
     "max_score": null,
     "hits": []
   },
   "aggregations": {
     "host": {
       "doc_count": 0,
       "results": {
         "hits": {
           "total": {
             "value": 0,
             "relation": "eq"
           },
           "max_score": null,
           "hits": []
         }
       }
     },
     "destination": {
       "doc_count": 10317,
       "geo": {
         "doc_count": 10317,
         "results": {
           "hits": {
             "total": {
               "value": 10317,
               "relation": "eq"
             },
             "max_score": null,
             "hits": [
               {
                 "_index": "bluecoat-2020.11",
                 "_type": "_doc",
                 "_id": "rsHy6HABRlOyzcJIDe9r",
                 "_score": null,
                 "_source": {
                   "destination.geo": {
                     "location": {
                       "lon": -83.0235,
                       "lat": 39.9653
                     }
                   },
                   "destination.geo.city_name": "Columbus",
                   "destination.geo.country_iso_code": "US",
                   "destination.geo.region_name": "Ohio",
                   "destination.geo.continent_name": "NA",
                   "destination.geo.country_name": "United States",
                   "destination.geo.region_iso_code": "OH"
                 },
                 "sort": [
                   1583806940000
                 ]
               }
             ]
           }
         }
       },
       "as": {
         "doc_count": 10317,
         "results": {
           "hits": {
             "total": {
               "value": 10317,
               "relation": "eq"
             },
             "max_score": null,
             "hits": [
               {
                 "_index": "bluecoat-2020.11",
                 "_type": "_doc",
                 "_id": "rsHy6HABRlOyzcJIDe9r",
                 "_score": null,
                 "_source": {
                   "destination.as.number": "16509",
                   "[destination.as.organization.name](http://destination.as.organization.name)": Amazon.com, Inc."
                 },
                 "sort": [
                   1583806940000
                 ]
               }
             ]
           }
         }
       },
       "lastSeen": {
         "value": 1583806940000,
         "value_as_string": "2020-03-10T02:22:20.000Z"
       },
       "firstSeen": {
         "value": 1583806044000,
         "value_as_string": "2020-03-10T02:07:24.000Z"
       }
     },
     "source": {
       "doc_count": 0,
       "geo": {
         "doc_count": 0,
         "results": {
           "hits": {
             "total": {
               "value": 0,
               "relation": "eq"
             },
             "max_score": null,
             "hits": []
           }
         }
       },
       "as": {
         "doc_count": 0,
         "results": {
           "hits": {
             "total": {
               "value": 0,
               "relation": "eq"
             },
             "max_score": null,
             "hits": []
           }
         }
       },
       "lastSeen": {
         "value": null
       },
       "firstSeen": {
         "value": null
       }
     }
   }
 }

```

**Network IP Data**

 ![SIEM_AS_Info](https://us1.discourse-cdn.com/elastic/original/3X/2/9/294c361d48fc4702466390813e21a5fb922dc28a.png)

**Response Data**

 ![SIEM_AS_Info_2](https://us1.discourse-cdn.com/elastic/original/3X/8/6/865ea85e45c8ad425077ccb128eedfe8fbe33b53.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 14, 2020, 4:23pm UTC](https://discuss.elastic.co/t/kibana-siem-application-is-not-displaying-proper-as-and-geoip-fields/223972/2 "2020-04-14T16:23:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.