# Logstash problems with fields (Point to Point)
**URL:** https://discuss.elastic.co/t/logstash-problems-with-fields-point-to-point/277196
**Category:** Logstash
**Created:** [June 28, 2021, 10:01am UTC](https://discuss.elastic.co/t/logstash-problems-with-fields-point-to-point/277196 "2021-06-28T10:01:16Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Michael\_Dylan\_McAloo](https://discuss.elastic.co/u/Michael_Dylan_McAloo)
#### Post date: [June 28, 2021, 10:01am UTC](https://discuss.elastic.co/t/logstash-problems-with-fields-point-to-point/277196/1 "2021-06-28T10:01:16Z")
I have a problem, I have two IPs one source and one destination, for the source IP Logstash automatically creates a field called "geoip.location" that contains the latitude and longitude of the specific IP, but for the destination IP it does not create any field like the "geoip.location" of the source and I do not know how to perform for example a Point to Point in Kibana without a field with the geolocation of the destination IP.
Logstash code:
```auto
input {
file {
path => "/var/log/snort/alert_fast.txt"
start_position => "beginning"
}
}
filter {
dissect { mapping => { "message" => '%{ts} [%{trash}] [%{fd1}] "%{alert}" [%{fd2}} %{ip_ori}:%{port_ori} %{fd3} %{ip_dest}:%{port_dest}' } }
geoip { source => "ip_ori" }
geoip { source => "ip_dest" target => "dest" }
}
output {
elasticsearch {
hosts => "http://localhost:9200"
index => "logstash-snort3a"
}
stdout { codec => rubydebug }
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 28, 2021, 4:28pm UTC](https://discuss.elastic.co/t/logstash-problems-with-fields-point-to-point/277196/2 "2021-06-28T16:28:48Z")
The default target for a geoip filter is geoip (assuming ECS compatability is disabled). The [default template](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/476097712b67e0452099769b2c8b0ef6e63e40eb/lib/logstash/outputs/elasticsearch/templates/ecs-disabled/elasticsearch-7x.json#L33) for an elasticsearch output configures [geoip][location] to be a geo\_point. If you want any other fields to be of type geo\_point then you must supply your own [template](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-templates.html).
---
### Author:  [@Michael\_Dylan\_McAloo](https://discuss.elastic.co/u/Michael_Dylan_McAloo)
#### Post date: [July 1, 2021, 11:23am UTC](https://discuss.elastic.co/t/logstash-problems-with-fields-point-to-point/277196/3 "2021-07-01T11:23:29Z")
But it is a field that can be used as origin and destination for the kibana "Point to Point" map?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 29, 2021, 11:23am UTC](https://discuss.elastic.co/t/logstash-problems-with-fields-point-to-point/277196/4 "2021-07-29T11:23:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.