# Netflow w/GeoIP always results in \_grokparsefailure

**URL:** <https://discuss.elastic.co/t/netflow-w-geoip-always-results-in--grokparsefailure/74559>\
**Category:** Logstash\
**Created:** [February 9, 2017, 8:15pm UTC](https://discuss.elastic.co/t/netflow-w-geoip-always-results-in--grokparsefailure/74559 "2017-02-09T20:15:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![AJSchroeder\_DS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajschroeder_ds/32/15394_2.png) [@AJSchroeder\_DS](https://discuss.elastic.co/u/AJSchroeder_DS)\
**Post date:** [February 9, 2017, 8:15pm UTC](https://discuss.elastic.co/t/netflow-w-geoip-always-results-in--grokparsefailure/74559/1 "2017-02-09T20:15:18Z")

</div>

Hello,

I'm pretty new to ELK, but I'm trying to get ELK stood up to collect Netflow data from our network devices. I'm also using the GeoIP location abilities and no matter what the messages that show up in elasticsearch are tagged with '\_grokparsefailure' and '\_geoip\_lookup\_failure'. Here is an example of a netflow record from logstash:

{  
"netflow":{  
"output\_snmp":2,  
"dst\_as":0,  
"dst\_mask":22,  
"in\_pkts":2,  
"ipv4\_dst\_addr":"10.0.2.124",  
"src\_tos":0,  
"first\_switched":"2017-02-05T02:21:27.999Z",  
"flowset\_id":256,  
"l4\_src\_port":80,  
"ipv4\_next\_hop":"10.0.2.124",  
"src\_mask":0,  
"version":9,  
"flow\_seq\_num":1549640,  
"ipv4\_src\_addr":"173.192.194.67",  
"in\_bytes":128,  
"protocol":6,  
"last\_switched":"2017-02-05T02:21:32.999Z",  
"input\_snmp":1,  
"tcp\_flags":24,  
"flow\_sampler\_id":0,  
"protocolIndentifierString":"TCP",  
"l4\_dst\_port":55627,  
"direction":1,  
"src\_as":0  
},  
"srcip":"173.192.194.67",  
"dst\_geoip":{

},  
"@timestamp":"2017-02-05T02:21:45.000Z",  
"geoip":{  
"timezone":"America/New\_York",  
"ip":"173.192.194.67",  
"latitude":38.9036,  
"continent\_code":"NA",  
"city\_name":"Chantilly",  
"country\_code2":"US",  
"country\_name":"United States",  
"dma\_code":511,  
"country\_code3":"US",  
"region\_name":"Virginia",  
"location":[  
-77.4512,  
38.9036  
],  
"postal\_code":"20151",  
"longitude":-77.4512,  
"region\_code":"VA"  
},  
"@version":"1",  
"host":"192.168.0.254",  
"src\_geoip":{

},  
"dstip":"10.0.2.124",  
"type":"netflow",  
"tags":[  
"\_grokparsefailure",  
"\_geoip\_lookup\_failure"  
]  
}

I'm not really sure what I am doing wrong here, but does anyone have any ideas?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2017, 8:15pm UTC](https://discuss.elastic.co/t/netflow-w-geoip-always-results-in--grokparsefailure/74559/2 "2017-03-09T20:15:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.