# Logstash geoIP and dissect issues

**URL:** <https://discuss.elastic.co/t/logstash-geoip-and-dissect-issues/104944>\
**Category:** Logstash\
**Created:** [October 23, 2017, 5:55pm UTC](https://discuss.elastic.co/t/logstash-geoip-and-dissect-issues/104944 "2017-10-23T17:55:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![maddie0726](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@maddie0726](https://discuss.elastic.co/u/maddie0726)\
**Post date:** [October 23, 2017, 5:55pm UTC](https://discuss.elastic.co/t/logstash-geoip-and-dissect-issues/104944/1 "2017-10-23T17:55:05Z")

</div>

I'm having a couple issues, not sure if its syntax or what. End result is that I want to read in a 24 hour old .txt file, mimic it being read in as live data, extract an outside IP address from the message field (greedydata field) and use that with geoip to put the IP address on a map in kibana. The rest of the data in each entry is irrelevant. Here is my config file:  
input {  
file {  
path =\> "//ntsvc/Logs/SyslogCatchAll-2017-10-22.txt"  
start\_position =\> "beginning"  
sincedb\_path =\> "NUL"  
ignore\_older =\> 0  
}

filter {  
throttle {  
period =\> 1  
max\_age =\> 3  
before\_count =\> 3  
after\_count =\> 20  
key =\> "%{message}"  
#this is the only way I have found to somewhat mimic live is to limit entries per second  
}  
grok {  
named\_captures\_only =\> 'false'  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp}%{SPACE}Local4.%{LOGLEVEL:level}%{SPACE}%{IP:ourIP}%{SPACE}%{CISCOTIMESTAMP:time}: %%{CISCOTAG:asa}%{GREEDYDATA:messageEnd}" }  
}  
if "outside" in [messageEnd] {  
dissect {  
mapping =\> {  
"message" =\> "%{?outside:}%[IP:ip]: %{msg}"  
}  
#attempting to use outside: as a delimiter, store the next portion as IP address, store the rest as msg  
}  
} else {  
drop{ }  
}  
#drop all entries without an outside IP address  
geoIP {  
source =\> "ip"  
}  
}

output {  
elasticsearch {  
hosts =\> [localhost:9200]  
}  
}

GeoIP is not working. I could not quite understand how to use the dissect filter after reading the documentation, so I have a very strong feeling I have that portion incorrect.

Thanks for any help!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 23, 2017, 8:22pm UTC](https://discuss.elastic.co/t/logstash-geoip-and-dissect-issues/104944/2 "2017-10-23T20:22:41Z")

</div>

This is basically the same question as [Logstash Dissect Filter](https://discuss.elastic.co/t/logstash-dissect-filter/104907).

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 23, 2017, 10:02pm UTC](https://discuss.elastic.co/t/logstash-geoip-and-dissect-issues/104944/3 "2017-10-23T22:02:58Z")

</div>

As Magnus mentions, it would be better if you update the original thread with this extra info as it helps others understand the problem and what you've already worked through 🙂

> [@Logstash Dissect Filter](https://discuss.elastic.co/t/logstash-dissect-filter/104907):
>
> I have Logstash Kibana and Elasticsearch versions 5.6.2 installed on Windows 2012 R2. I have a grok pattern that reads in text file entries adequately. The end of each entry is a message field containing a couple different formats; sometimes an IP adress, sometimes 2 IP addresses and different messages attached. What I need is to pull only the entries that have an outside IP address and I need to pull that IP address and put it in a field and use it as the source for geoIP. I was thinking of usi…

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 23, 2017, 10:03pm UTC](https://discuss.elastic.co/t/logstash-geoip-and-dissect-issues/104944/4 "2017-10-23T22:03:16Z")

</div>