# Logstash AWS ElasticSearch geoip not shows up

**URL:** <https://discuss.elastic.co/t/logstash-aws-elasticsearch-geoip-not-shows-up/83184>\
**Category:** Elasticsearch\
**Created:** [April 21, 2017, 9:30am UTC](https://discuss.elastic.co/t/logstash-aws-elasticsearch-geoip-not-shows-up/83184 "2017-04-21T09:30:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![khteh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khteh/32/147573_2.png) [@khteh](https://discuss.elastic.co/u/khteh)\
**Post date:** [April 21, 2017, 9:30am UTC](https://discuss.elastic.co/t/logstash-aws-elasticsearch-geoip-not-shows-up/83184/1 "2017-04-21T09:30:59Z")

</div>

I have the following logstash pipeline configuration:  
input {  
beats {  
port =\> "5044"  
}  
}

# The filter part of this file is commented out to indicate that it is

# optional.

filter {  
grok {  
match =\> { "message" =\> "%{COMBINEDAPACHELOG}" }  
}  
date {  
match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]  
}  
geoip {  
source =\> "clientip"  
target =\> "geoip"  
database =\> "/etc/logstash/GeoLite2-City.mmdb"  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float"]  
}  
}  
output {  
elasticsearch {

# hosts =\> ["localhost:9200"]

```
            hosts => ["<foo>:80"]
            index => "weeloy.asia"
    }   
    stdout { codec => rubydebug }

```

}

This is one of the log message that shows up at the ElasticSearch:  
@timestamp:April 21st 2017, 17:22:42.033 offset:19,804 @version:1 input\_type:log beat.hostname:9667b2238b44 beat.name:9667b2238b44 beat.version:5.3.0 host:9667b2238b44 source:/var/log/apache2/dev.weeloy.asia-error\_log message:[Fri Apr 21 09:22:32.161233 2017] [:error] [pid 23634] [client 118.200.155.89:52099] LOGIN member, referer: http:// type:apache-access tags:beats\_input\_codec\_plain\_applied, \_grokparsefailure, \_geoip\_lookup\_failure \_id:AVuP0iWx4iBeUK45wU1T \_type:apache-access \_index:weeloy.asia \_score: -

I just cannot get geoip to work. Any advice and insight is appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 19, 2017, 9:34am UTC](https://discuss.elastic.co/t/logstash-aws-elasticsearch-geoip-not-shows-up/83184/2 "2017-05-19T09:34:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.