No geopoint for destination.ip but latitude and longitude field - 7.10

[Camille (P)]

Hi,

i'm trying to use "geoip" module on a destination.ip.

My logstash code is :

    if [destination.ip] {
          geoip {
            source => "destination.ip"
            target => "destination.geo"
          }
    }

Geoip is working (almost fine), I have new fields in the Elastic output but no geopoint. I can see "destination.geo.location.lat" and "destination.geo.location.lon" as number field but no "destination.geo.location" whereas it is defined in my index template (see image)

Am I missing something ?

Thanks for help

[PraveenKT (Praveen Kumar Teegala)]

try to add below section to logstash conf.d file.

filter {
geoip {
   source => "[destination][ip]"
   target => "[destination][geo]"}
geoip {
   source => "[source][ip]"
   target => "[source][geo]"
    }
}
~~~~~~~~~~~~~~~~

[Camille (P)]

Thanks for your reply, I'm trying it and waiting for new alarms.

[Camille (P)]

Hi,

Issue is solved, it was due to the source field type (ip instead of string as expected by geoip).