], :response=>{"index"=>{"_index"=>"packetbeat-6.5.4-2019.01.21", "_type"=>"doc", "_id"=>"y6LBcWgBO-eHSZ_RR-lB", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse", "caused_by"=>{"type"=>"parse_exception", "reason"=>"field must be either [lat], [lon] or [geohash]"}}}}}
```
But still doesn't showing any geoip point:
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 21, 2019, 7:07pm UTC](https://discuss.elastic.co/t/logstash-geoip-in-packetbeat-pattern/165100/6 "2019-01-21T19:07:52Z")
You got an \_geoip\_lookup\_failure tag because geoip has no way of knowing where 127.0.0.1 is. Mine is in Virginia, but yours may be somewhere else 😃
The WARN messages are actually good news, because they suggest your index mapping is correctly set up to expect a geo\_point for location. Once you get geoip working I would expect them to disappear.
---
### Author:  [@Miguel\_Plazas](https://discuss.elastic.co/u/Miguel_Plazas)
#### Post date: [January 22, 2019, 2:36pm UTC](https://discuss.elastic.co/t/logstash-geoip-in-packetbeat-pattern/165100/7 "2019-01-22T14:36:25Z")
Thanks, but still not working, it's not showing anything, and no match:
This is the request:
```
{
"aggs": {
"filter_agg": {
"filter": {
"geo_bounding_box": {
"ignore_unmapped": true,
"client_geoip.location": {
"top_left": {
"lat": 90,
"lon": -180
},
"bottom_right": {
"lat": -90,
"lon": 180
}
}
}
},
"aggs": {
"2": {
"geohash_grid": {
"field": "client_geoip.location",
"precision": 2
},
"aggs": {
"3": {
"geo_centroid": {
"field": "client_geoip.location"
}
}
}
}
}
}
},
"size": 0,
"_source": {
"excludes": []
},
"stored_fields": [
"*"
],
"script_fields": {},
"docvalue_fields": [
{
"field": "@timestamp",
"format": "date_time"
},
{
"field": "last_time",
"format": "date_time"
},
{
"field": "start_time",
"format": "date_time"
},
{
"field": "tls.client_certificate.not_after",
"format": "date_time"
},
{
"field": "tls.client_certificate.not_before",
"format": "date_time"
},
{
"field": "tls.server_certificate.not_after",
"format": "date_time"
},
{
"field": "tls.server_certificate.not_before",
"format": "date_time"
}
],
"query": {
"bool": {
"must": [
{
"query_string": {
"query": "*",
"analyze_wildcard": true,
"default_field": "*"
}
},
{
"query_string": {
"analyze_wildcard": true,
"query": "*",
"default_field": "*"
}
},
{
"range": {
"@timestamp": {
"gte": 1548166338211,
"lte": 1548167238211,
"format": "epoch_millis"
}
}
}
],
"filter": [],
"should": [],
"must_not": []
}
}
}
```
What could be the problem? and How can i prove that the config file it's doing it works?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 22, 2019, 3:21pm UTC](https://discuss.elastic.co/t/logstash-geoip-in-packetbeat-pattern/165100/8 "2019-01-22T15:21:54Z")
> [@Miguel\_Plazas](#):
>
> How can i prove that the config file it's doing it works?
If you want to know whether logstash is doing what you want then look at the events written to stdout. Leave elasticsearch and kibana out of it. You already have
```
stdout { codec => rubydebug }
```
in your configuration. Are you able to view that output?
---
### Author:  [@Miguel\_Plazas](https://discuss.elastic.co/u/Miguel_Plazas)
#### Post date: [January 22, 2019, 4:22pm UTC](https://discuss.elastic.co/t/logstash-geoip-in-packetbeat-pattern/165100/9 "2019-01-22T16:22:36Z")
I think it's ingesting:
 !
But it still not showing anything 😥
I tried with Packetbeatgeoip, and neither ðŸ˜
I followed this steps: [https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-geoip.html](https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-geoip.html)
Installing the plugin:
`sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-geoip`
Adding ingest pipeline:
Modifing output of packetbeat.yml:
output.elasticsearch:
hosts: ["localhost:9200"]
pipeline: geoip-info
Starting Packetbeat with new configs:
`sudo /usr/share/packetbeat/bin/packetbeat -e -c /etc/packetbeat/packetbeat.yml`
In console it's showing this:
and i think it's indexing:
but as i mention before, still not working ðŸ˜ðŸ˜ðŸ˜ðŸ˜
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 22, 2019, 4:47pm UTC](https://discuss.elastic.co/t/logstash-geoip-in-packetbeat-pattern/165100/10 "2019-01-22T16:47:28Z")
The client\_ip is in the 192.168/16 net block. That cannot be geolocated because it is used at different locations by different organizations. If you try doing geoip on the ip field you should get a hit on Mountain View.
---
### Author:  [@Miguel\_Plazas](https://discuss.elastic.co/u/Miguel_Plazas)
#### Post date: [January 22, 2019, 4:50pm UTC](https://discuss.elastic.co/t/logstash-geoip-in-packetbeat-pattern/165100/11 "2019-01-22T16:50:09Z")
So, theoretically if i follow the steps of the ingest geoip plugin in a server it will work?
This is a bar-plot of **client\_ip** :
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 22, 2019, 5:36pm UTC](https://discuss.elastic.co/t/logstash-geoip-in-packetbeat-pattern/165100/12 "2019-01-22T17:36:08Z")
Unfortunately none of those client\_ip value will get a match grom geoip.
---
### Author:  [@Miguel\_Plazas](https://discuss.elastic.co/u/Miguel_Plazas)
#### Post date: [January 22, 2019, 6:41pm UTC](https://discuss.elastic.co/t/logstash-geoip-in-packetbeat-pattern/165100/13 "2019-01-22T18:41:35Z")
Thanks. Something curious is that when I don't use neither LogStash or Plugin GeoIp, just using Packbeat, It looks like clien\_ip is getting external data:
So, the LogStas config or GeoIp Elastic Plugin is filtering all other ip's? I'm confuse in this point.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 19, 2019, 6:41pm UTC](https://discuss.elastic.co/t/logstash-geoip-in-packetbeat-pattern/165100/14 "2019-02-19T18:41:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.