# Logstash help with geoip mapping from csv file **URL:** \ **Category:** Logstash\ **Created:** [February 20, 2019, 2:02pm UTC](https://discuss.elastic.co/t/logstash-help-with-geoip-mapping-from-csv-file/169229 "2019-02-20T14:02:46Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mmalisa12](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mmalisa12/32/41145_2.png) [@mmalisa12](https://discuss.elastic.co/u/mmalisa12)\ **Post date:** [February 20, 2019, 2:02pm UTC](https://discuss.elastic.co/t/logstash-help-with-geoip-mapping-from-csv-file/169229/1 "2019-02-20T14:02:47Z")
Hi, sorry for asking, but went through code, help, FAQ and i still cant make it work. I have CSV file with two fields which contains IP address. When importing from Kibana directly i can make this fields to be recognized as IP address, but no langitude and longitude added, and i have proper database with needed data added to Elasticsearch (version 6.x). I tryed going with logstash config file: input { file { path =\> "c:/users/maki/downloads/dump.txt" start\_position =\> "beginning" sincedb\_path =\> "C:/users/maki/downloads/brojac.txt" } } filter { csv { separator =\> "," columns =\> ["Flgs","RunTime","IdleTime","Proto","Sport","Dport","sTos","dTos","sDSb","dDSb","sTtl","dTtl","TotPkts","SrcPkts","DstPkts","TotBytes","SrcBytes","DstBytes","Load","SrcLoad","DstLoad","Loss","SrcLoss","DstLoss","pLoss","SrcGap","DstGap","Rate","SrcRate","DstRate","Dir","State","SrcWin","DstWin","SrcTCPBase","DstTCPBase","TcpRtt","SynAck","AckDat","sMeanPktSz","dMeanPktSz","SrcAddr","DstAddr","StartTime","LastTime"] } geoip{ source =\> "SrcAddr","DstAddr" } } output { elasticsearch { hosts =\> "[http://localhost:9200](http://localhost:9200)" index =\> "security4" } stdout {} } I was using recommendation from this page: [https://www.elastic.co/blog/geoip-in-the-elastic-stack](https://www.elastic.co/blog/geoip-in-the-elastic-stack) Where they said that mutate or adding new field is not needed anymore, since geoip filter is doing this automatic now. But when trying to import i receive error with: ConfigurationError", :message=\>"Expected one of #, {, } at line 14, column 20 (byte 666) after filter So if anyone willing to help and have spare time, it would be great. Thank you in advance. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 20, 2019, 2:22pm UTC](https://discuss.elastic.co/t/logstash-help-with-geoip-mapping-from-csv-file/169229/2 "2019-02-20T14:22:15Z")
> [@mmalisa12](#): > > geoip{ > source =\> "SrcAddr","DstAddr" > } Try ``` geoip{ source => "SrcAddr" } ``` That will add a field called geoip which should show up in kibana as a geo\_point. Then use a second filter for the second field ``` geoip { source => "DstAddr" target => "someField" } ``` That will not be a geo\_point unless you add a mapping template. [This](https://discuss.elastic.co/t/location-dosent-convert-to-geo-point/131199/4) thread might help with that. Then you can change the target of the first filter as well 🙂 ---
**Author:** ![mmalisa12](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mmalisa12/32/41145_2.png) [@mmalisa12](https://discuss.elastic.co/u/mmalisa12)\ **Post date:** [February 21, 2019, 2:09pm UTC](https://discuss.elastic.co/t/logstash-help-with-geoip-mapping-from-csv-file/169229/3 "2019-02-21T14:09:15Z")
> [@Badger](#): > > geoip{ source =\> "SrcAddr" } Hi, thank you for reply, appreciate it! i did: `geoip{ source => "SrcAddr" }` and it worked, tryed to add below: `geoip{ source => "DstAddr" }` that didnt work, so it would be nice to know how i can do geoip for two fields, SrcAddr and DstAddr. Now, i didnt get what i expected: while i see results in elasticsearch, they are not geoip type as it looks, i cant do mapping, it say there is no geohash available field in my new index. I have fields like: `geoip.coutry_name, geoip.longitude` but they have keyword at the end.Also, when importing from Kibana, i can say that field SrcAddr and DstAddr are IP type. When i did mapping for my index, i could not edit or alter fields, i just have option to create nex index pattern and that is it. Let me know should i open new thread, or we can continue to do it here. Best regards ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 21, 2019, 2:10pm UTC](https://discuss.elastic.co/t/logstash-help-with-geoip-mapping-from-csv-file/169229/4 "2019-02-21T14:10:52Z")
If you want two geo\_point fields you have to have a mapping template. The thread I linked to before should help you with that. ---
**Author:** ![mmalisa12](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mmalisa12/32/41145_2.png) [@mmalisa12](https://discuss.elastic.co/u/mmalisa12)\ **Post date:** [February 21, 2019, 3:06pm UTC](https://discuss.elastic.co/t/logstash-help-with-geoip-mapping-from-csv-file/169229/5 "2019-02-21T15:06:42Z")
Thank you for your answer. Now i am investigating how data are imported to elasticsearch.Now i have after each field new one with .keyword at the end.When i import from Kibana i just got 50 fields, like i should have.Also, no geoip available fields for geohash, so let me know should i move to new question to solve problem by problem? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 21, 2019, 3:19pm UTC](https://discuss.elastic.co/t/logstash-help-with-geoip-mapping-from-csv-file/169229/6 "2019-03-21T15:19:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.