# Multiple geoip does not work?

**URL:** <https://discuss.elastic.co/t/multiple-geoip-does-not-work/205486>\
**Category:** Elasticsearch\
**Created:** [October 28, 2019, 2:31pm UTC](https://discuss.elastic.co/t/multiple-geoip-does-not-work/205486 "2019-10-28T14:31:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jahlives](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jahlives](https://discuss.elastic.co/u/jahlives)\
**Post date:** [October 28, 2019, 2:31pm UTC](https://discuss.elastic.co/t/multiple-geoip-does-not-work/205486/1 "2019-10-28T14:31:48Z")

</div>

Hi

I try to get two geoip lookups working. Found target option in the mangpages. But now I'm stuck with the elastic template. It seems that the mapping from json template is not applied.

```
 "mappings":{
     "properties":{
       "ip_src": {
         "type": "object",
         "dynamic": true,
         "properties": {
           "location" : { "type": "geo_point" },
           "latitude" : { "type" : "half_float" },
           "longitude" : { "type" : "half_float" },
           "ip" : { "type" : "ip" }
         }
       },
       "ip_dst": {
         "type": "object",
         "dynamic": true,
         "properties": {
           "location" : { "type": "geo_point" },
           "latitude" : { "type" : "half_float" },
           "longitude" : { "type" : "half_float" },
           "ip" : { "type" : "ip" }
         }
       },

```

my filter in logstash looks like this

```
if "" in [ipto] {
  geoip {
    source => "ipto"
    target => "ip_dst"
  }
  mutate {
    replace => ["type", "connection"]
  }
}
if "" in [ipfrom] {
  geoip {
    source =>"ipfrom"
    target => "ip_src"
  }
  mutate {
    replace => ["type", "connection"]
  }
}

```

and the relevant part from output

```
if [type] == "connection" {
elasticsearch {
  index => "connection-%{+YYYY.MM.dd}"
  hosts => "localhost:9200"
  manage_template => true
  template_overwrite => true
  template => "/etc/logstash/config/templates/connection.json"
  template_name => "connection"
 } 
}

```

I deleted the template from elastic and installed it again to be sure. But this does not work in my case. The fields are always mapped as wrong type (ex ip\_src.ip is of type string and ip\_src.location is not present at all). I have other indices where I use geoip without target and there it works fine with all mappings

Any idea what I'm missing? Thanks for any help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 25, 2019, 2:31pm UTC](https://discuss.elastic.co/t/multiple-geoip-does-not-work/205486/2 "2019-11-25T14:31:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.