# Logstash GeoIP filter (Tile map)

**URL:** <https://discuss.elastic.co/t/logstash-geoip-filter-tile-map/52463>\
**Category:** Logstash\
**Created:** [June 10, 2016, 5:00pm UTC](https://discuss.elastic.co/t/logstash-geoip-filter-tile-map/52463 "2016-06-10T17:00:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\
**Post date:** [June 10, 2016, 5:00pm UTC](https://discuss.elastic.co/t/logstash-geoip-filter-tile-map/52463/1 "2016-06-10T17:00:44Z")

</div>

Hi,  
I am trying to use GeoIP filter to display geographical location of IP addresses. I followed this tutorial [https://www.digitalocean.com/community/tutorials/how-to-map-user-location-with-geoip-and-elk-elasticsearch-logstash-and-kibana](https://www.digitalocean.com/community/tutorials/how-to-map-user-location-with-geoip-and-elk-elasticsearch-logstash-and-kibana)

I am using ELK stack with Redis as the queue. I am not using Nginx or Filebeat or lumberjack as shown in this tutorial.  
The problem i am facing is, I am seeing the geoIP field in kibana even though i added the following lines to my logstash-shipper conf file

geoip {  
source =\> "clientip"  
target =\> "geoip"  
database =\> "/etc/logstash/GeoLiteCity.dat"  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float"]  
}

Can anyone tell me what's going on here?

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [June 11, 2016, 6:41am UTC](https://discuss.elastic.co/t/logstash-geoip-filter-tile-map/52463/2 "2016-06-11T06:41:09Z")

</div>

Replace the config with this

```auto
geoip {
  source => "clientip"
  target => "geoip"
  fields => ["country_code2", "country_name", "continent_code", "region_name", "real_region_name", "city_name", "postal_code", "timezone", "location"]
}

```

Remove the `fields => [......` line and you'll get all geo fields.  
The mapping type of geoip.location should be geo\_point as in

```auto
"geoip": {
  "dynamic": true,
  "type": "object",
  "properties": {
    "location": {
      "type": "geo_point"
    }
  }
}

```

You should then use `geoip.location` in your tile map. I'm not sure why I keep seeing this config from digitalocean with converting to float type.

For more info, you can check [http://www.secureict.info/2015/11/process-netflow-with-nprobe-and\_20.html](http://www.secureict.info/2015/11/process-netflow-with-nprobe-and_20.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/logstash-geoip-filter-tile-map/52463/3 "2017-07-06T04:53:31Z")

</div>