# Logstash Condiational Filtering Issue with Geo Location

**URL:** <https://discuss.elastic.co/t/logstash-condiational-filtering-issue-with-geo-location/343596>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [September 22, 2023, 6:42am UTC](https://discuss.elastic.co/t/logstash-condiational-filtering-issue-with-geo-location/343596 "2023-09-22T06:42:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![M\_Hatam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_hatam/32/121792_2.png) [@M\_Hatam](https://discuss.elastic.co/u/M_Hatam)\
**Post date:** [September 22, 2023, 6:42am UTC](https://discuss.elastic.co/t/logstash-condiational-filtering-issue-with-geo-location/343596/1 "2023-09-22T06:42:40Z")

</div>

Hi Everyone,

Sorry if this is answered somewhere else and I would appreciate if you can help.

I'm sending logs from FortiGate to Logstash and I want to set geoip location to be sent to Elasticsearch. Since some traffic on the FortiGate is from internal private IPs, including external VPNs etc., I want to somehow tell Logstash that when the destination is not the Internet-facing interface it should use a public address (here for test 8.8.8.8), and when it sees the traffic comes from the internal interface (Port10), it should use the NAT IP

This is the filter I wrote, but it gives error

```auto
if "dstintf" != "port1" {
    geoip {
      default_database_type => "City"
      source => "8.8.8.8"
      tag_on_failure => ["_dst_city_geo_failure"]
      target => "dst_ip"
    }
  } else {
      default_database_type => "City"
      source => "dstip"
      tag_on_failure => ["_dst_city_geo_failure"]
      target => "dst_ip"
    }

  if "srcintf" == "port10" {
  geoip {
    default_database_type => "City"
    source => "transip"
    tag_on_failure => ["_src_city_geo_failure"]
    target => "src_ip"
    }
  } else {
      default_database_type => "City"
      source => "srcip"
      tag_on_failure => ["_src_city_geo_failure"]
      target => "src_ip"
    }

```

This is the error I get:

```auto
[WARN] 2023-09-22 16:19:10.754 [[main]>worker0] elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"firewall-2023.09.22", :routing=>nil}, {HERE THE PAIR VALUES OF LOGS ARE, I REMOVED THEM FOR READABILITY PURPOSE}], :response=>{"index"=>{"_index"=>"fortigate-2023.09.22", "_id"=>"w9qKu4oBu3VwOasdztwD", "status"=>400, "error"=>{"type"=>"document_parsing_exception", "reason"=>"[1:717] failed to parse field [src_loc] of type [geo_point]", "caused_by"=>{"type"=>"parse_exception", "reason"=>"latitude must be a number"}}}}}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 22, 2023, 5:57pm UTC](https://discuss.elastic.co/t/logstash-condiational-filtering-issue-with-geo-location/343596/2 "2023-09-22T17:57:09Z")

</div>

> [@M\_Hatam](#):
>
> `failed to parse field [src_loc] of type [geo_point]", "caused_by"=>{"type"=>"parse_exception", "reason"=>"latitude must be a number"}`

Where are you setting the src\_loc field? elasticsearch will parse [several different formats](https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html#geo-point) for a geo\_point, but in all of them latitude and longitude have to be recognizable as numbers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 20, 2023, 5:57pm UTC](https://discuss.elastic.co/t/logstash-condiational-filtering-issue-with-geo-location/343596/3 "2023-10-20T17:57:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.