# Logstash service crash 6.6 (geoip) filter

**URL:** <https://discuss.elastic.co/t/logstash-service-crash-6-6-geoip-filter/172641>\
**Category:** Logstash\
**Created:** [March 16, 2019, 1:20pm UTC](https://discuss.elastic.co/t/logstash-service-crash-6-6-geoip-filter/172641 "2019-03-16T13:20:54Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![naftalin\_n](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/naftalin_n/32/42007_2.png) [@naftalin\_n](https://discuss.elastic.co/u/naftalin_n)\
**Post date:** [March 16, 2019, 1:20pm UTC](https://discuss.elastic.co/t/logstash-service-crash-6-6-geoip-filter/172641/1 "2019-03-16T13:20:54Z")

</div>

Hi,  
I using filebeat with elk stack 6.6.3  
Logstash service crash when getting json log with remote address fo Geoip filter.

here is my configuration file:

```
input {
  beats {
    port => 5044
  }
}

filter {
        grok{
                 overwrite => ["message"]
        }

        json {
         source => "message"

        }

        geoip {
         source => "[host]"
        }

        date {
                match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
                locale => en
                remove_field => "timestamp"
        }
        mutate{
                convert => { "bytes" => "integer" }
                remove_field => ["prospector","tags","@version","input","beat","log"]
        }
}

output {
        stdout {
                codec => dots
        }
        elasticsearch {
                        hosts => ["http://localhost:9200"]
                        index => "logs-%{[verticle]}-%{[log_origin]}-log-%{[@metadata][version]}-%{+YYYY.MM.dd}"
        }
}

```

I am getting the next error:

Exception in thread "[main]\>worker0" java.lang.IllegalArgumentException: Expected input field value to be String or List type  
at org.logstash.filters.GeoIPFilter.handleEvent(org/logstash/filters/GeoIPFilter.java:125)

can someone help me, what is wrong with this config? it used to work before..

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 16, 2019, 3:38pm UTC](https://discuss.elastic.co/t/logstash-service-crash-6-6-geoip-filter/172641/3 "2019-03-16T15:38:14Z")

</div>

> [@naftalin\_n](#):
>
> what is wrong with this config? it used to work before

For some time now, beats have set [host] to be an [object](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-beat.html). Generally beats will not send an IP address, they send a hostname.

---

<div class="post-metadata">

**Author:** ![naftalin\_n](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/naftalin_n/32/42007_2.png) [@naftalin\_n](https://discuss.elastic.co/u/naftalin_n)\
**Post date:** [March 17, 2019, 9:06am UTC](https://discuss.elastic.co/t/logstash-service-crash-6-6-geoip-filter/172641/4 "2019-03-17T09:06:49Z")

</div>

here is how my json string (message) looks like:

`{"UID":xxx,"AID":xxx,"log_origin":"client","response_code":0,"description":"Rout to: /user/logout","duration":0,"remote_details":{"uri":"/user/logout","port":15481,"local_Address":"111.11.11.111:111","remote_address":"111.111.111.111:16666","Host":" *****.com","Connection":"keep-alive","Content-Length":"65","Accept":"application/json, text/plain, */*","UID":"240","Origin":"https://*****.com","User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36","AID":"xxx","Content-Type":"application/json","Referer":"https://www. ***** r.com","Accept-Encoding":"gzip, deflate, br","Accept-Language":"en-US,en;q=0.9"},"host":"111.111.111.111","id":"INFO (6270) 13:10:45:872","time":"2019-03-14 13:10:45:872","host_name":"ip-111-11-11-111.eu-west-1.compute.internal","server_port":"443","level":"INFO","verticle":"xxx","remote_address":"111.11.11.111"}`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 17, 2019, 4:18pm UTC](https://discuss.elastic.co/t/logstash-service-crash-6-6-geoip-filter/172641/5 "2019-03-17T16:18:10Z")

</div>

If the event is JSON that contains a host field then that will overwrite the host object added by the beat, and the geoip will work. If it does not contain a host field then you should expect to get the error message that you got.

---

<div class="post-metadata">

**Author:** ![naftalin\_n](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/naftalin_n/32/42007_2.png) [@naftalin\_n](https://discuss.elastic.co/u/naftalin_n)\
**Post date:** [March 18, 2019, 5:59pm UTC](https://discuss.elastic.co/t/logstash-service-crash-6-6-geoip-filter/172641/6 "2019-03-18T17:59:08Z")

</div>

Thank you!

i changed the key ("host") name and it solved everything

---

<div class="post-metadata">

**Author:** ![Zoraida200](https://avatars.discourse-cdn.com/v4/letter/z/50afbb/32.png) [@Zoraida200](https://discuss.elastic.co/u/Zoraida200)\
**Post date:** [March 19, 2019, 6:10am UTC](https://discuss.elastic.co/t/logstash-service-crash-6-6-geoip-filter/172641/7 "2019-03-19T06:10:02Z")

</div>

Yes changing the host name worked..Cheers[.](https://www.mybkexperience.reviews/)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2019, 6:10am UTC](https://discuss.elastic.co/t/logstash-service-crash-6-6-geoip-filter/172641/8 "2019-04-16T06:10:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.