# Logstash geoip that works with Kibana SIEM UI

**URL:** <https://discuss.elastic.co/t/logstash-geoip-that-works-with-kibana-siem-ui/224288>\
**Category:** Logstash\
**Created:** [March 19, 2020, 3:46pm UTC](https://discuss.elastic.co/t/logstash-geoip-that-works-with-kibana-siem-ui/224288 "2020-03-19T15:46:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vincent\_Maury](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vincent_maury/32/59973_2.png) [@Vincent\_Maury](https://discuss.elastic.co/u/Vincent_Maury)\
**Post date:** [March 19, 2020, 3:46pm UTC](https://discuss.elastic.co/t/logstash-geoip-that-works-with-kibana-siem-ui/224288/1 "2020-03-19T15:46:18Z")

</div>

I'm using Logstash 7.6.0 with Elasticsearch & Kibana, and I figured out we need to change a couple of things to have geoip work with SIEM UI:

The Logstash config sample:

```
input {
	generator {
		count => 1
		message => "See 83.202.178.93 in SIEM UI"
	}
}

filter {
	dissect {
		mapping => { "message" => "See %{devicehostip} in SIEM UI" }
	}
	geoip {
		source => "devicehostip"
		target => "[source][geo]"
		default_database_type => "City"
	}
}

filter { mutate { rename => { 
	"host" => "[logstash][host]"
	"devicehostip" => "[source][ip]"
	"[source][geo][country_code2]" => "[source][geo][country_iso_code]"
} } }

output {
	elasticsearch {
		hosts => ["https://aaa.europe-west1.gcp.cloud.es.io:9243"]
		index => "geoip-siem-%{+YYYY.MM.dd}"
		user => "elastic"
		password => "bbb"
		manage_template => true
		template => "C:\Users\maury\Documents\tech\logstash-7.6.0\config\test-geoip-siem-template.json"
		template_name => "geoip-siem-template"
		template_overwrite => true
	}
  stdout {
    codec => rubydebug
  }
}

```

and the es mapping file:

```
{
  "index_patterns" : "geoip-siem*",
  "settings" : {
    "number_of_shards" : "1",
    "number_of_replicas" : "0",
    "index.refresh_interval" : "5s"
  },
  "mappings" : {
	  "properties" : {
		"@timestamp" : { "type" : "date" },
		"@version" : { "type" : "keyword" },
		"source": {
			"properties": {
				"geo": {
					"properties": {
						"location": {
							"type": "geo_point"
						},
						"country_iso_code": {
							"type": "keyword"
						}
					}
				},
				"ip": { "type" : "ip" }
			}
		}
	  }
	}
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2020, 3:46pm UTC](https://discuss.elastic.co/t/logstash-geoip-that-works-with-kibana-siem-ui/224288/2 "2020-04-16T15:46:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.