# Logstash GeoIP filter with words

**URL:** <https://discuss.elastic.co/t/logstash-geoip-filter-with-words/281638>\
**Category:** Logstash\
**Created:** [August 17, 2021, 7:43am UTC](https://discuss.elastic.co/t/logstash-geoip-filter-with-words/281638 "2021-08-17T07:43:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rodri.gz](https://avatars.discourse-cdn.com/v4/letter/r/aca169/32.png) [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\
**Post date:** [August 17, 2021, 7:43am UTC](https://discuss.elastic.co/t/logstash-geoip-filter-with-words/281638/1 "2021-08-17T07:43:51Z")

</div>

hello!

I have a log with countries but it does not have an IP field and I would like to make a map in kibana giving a latitude and longitude to that field.

If I had an IP I would know how to do it with geoip.  
Can this plugin be used with words?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 17, 2021, 2:23pm UTC](https://discuss.elastic.co/t/logstash-geoip-filter-with-words/281638/2 "2021-08-17T14:23:29Z")

</div>

You cannot use a geoip filter, but you can do it. You will need an index template that maps a field as a geo\_point. The [default template](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/476097712b67e0452099769b2c8b0ef6e63e40eb/lib/logstash/outputs/elasticsearch/templates/ecs-disabled/elasticsearch-7x.json#L37) does this for [geoip][location]. I guess you could reuse that, but I would recommend adding your own mapping.

Then use a translate filter. Get a list that maps a country to a latititude and longitude (e.g. [here](https://lab.lmnixon.org/4th/worldcapitals.html)) and convert that into format (e.g. yml) that the translate filter can use. Note that once the mapping is in place, [elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html) will have no problem parsing a string like "41.12,-71.34" and storing it in the geo\_point field. You do _not_ need to split that into two fields and convert them to floats.

---

<div class="post-metadata">

**Author:** ![rodri.gz](https://avatars.discourse-cdn.com/v4/letter/r/aca169/32.png) [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\
**Post date:** [August 18, 2021, 9:35am UTC](https://discuss.elastic.co/t/logstash-geoip-filter-with-words/281638/3 "2021-08-18T09:35:20Z")

</div>

First of all, thanks for the response!

Actually i have this config

```auto
filter {
    mutate {
        copy => {"fecha" => "@timestamp"}
  }

    mutate { add_field => {"lat" => "1.0" }}
    mutate { add_field => {"lon"=> "-1.0" }}
    mutate { convert => {"lat" => "float"} }
    mutate { convert => {"lon" => "float"} }

    if [cod_postal] == "01" {
      mutate {
        replace => { "lat" => "42.8351264353"}
        replace => { "lon" => "-2.72060346921"}
      }
    }
    if [cod_postal] == "02" {
      mutate {
        replace => { "lat" => "38.8254086192"}
        replace => { "lon" => "-1.98037326935"}
      }
    }
    if [cod_postal] == "03" {
      mutate {
        replace => { "lat" => "38.4786378049"}
        replace => { "lon" => "-0.568699068376"}
      }
    
    mutate { add_field => {"location" => "%{lat},%{lon}"} }

  output {
  elasticsearch {
    hosts => ["http://xxxx:9200"]
    index => "prueba-map-%{+YYYY}"
  }
}

```

I created an index template with the geo\_point field like this

![image](https://us1.discourse-cdn.com/elastic/original/3X/2/5/25959ff612277dd38ecec46f9362b3a8902f5d67.png)

when i launch logstash it index okey the fields

![image](https://us1.discourse-cdn.com/elastic/original/3X/0/5/057825ed9d53abd555b77e999d5bbbba10a356b7.png)

but when i try to create the map, it detect the geo\_point field but doesnt print anything and give this error...

```auto
"reason": "Field [location] is of unsupported type [keyword] for [geo_bounding_box] query"

```

thank you!

---

<div class="post-metadata">

**Author:** ![rodri.gz](https://avatars.discourse-cdn.com/v4/letter/r/aca169/32.png) [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\
**Post date:** [August 23, 2021, 7:01am UTC](https://discuss.elastic.co/t/logstash-geoip-filter-with-words/281638/4 "2021-08-23T07:01:21Z")

</div>

finally i solved it.

Here is my config.

```auto
  mutate {convert => ["Latitude", "float"] }
  mutate {convert => ["Longitude", "float"] }

    if [cod_country] == "xxxx" 
      mutate {
        replace => { "Latitude" => "yyyyyyyyy"}
        replace => { "Longitude" => "-zzzzzzz"}
      }
    }

    mutate{
    add_field => {"geoLocation" => "%{Latitude},%{Longitude}"}
    }

```

and adding a new field in mapping template.

![image](https://us1.discourse-cdn.com/elastic/original/3X/d/e/ded3e0ac3d98397a93736f94d02ef884d9c180d2.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2021, 7:01am UTC](https://discuss.elastic.co/t/logstash-geoip-filter-with-words/281638/5 "2021-09-20T07:01:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.