# Output of geoip filter changed in logstash 5.4.2 (no more GeoJSON)

**URL:** https://discuss.elastic.co/t/output-of-geoip-filter-changed-in-logstash-5-4-2-no-more-geojson/91186
**Category:** Logstash
**Created:** [June 28, 2017, 8:35pm UTC](https://discuss.elastic.co/t/output-of-geoip-filter-changed-in-logstash-5-4-2-no-more-geojson/91186 "2017-06-28T20:35:52Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![matejzero](https://avatars.discourse-cdn.com/v4/letter/m/e9bcb4/32.png) [@matejzero](https://discuss.elastic.co/u/matejzero)
#### Post date: [June 28, 2017, 8:35pm UTC](https://discuss.elastic.co/t/output-of-geoip-filter-changed-in-logstash-5-4-2-no-more-geojson/91186/1 "2017-06-28T20:35:52Z")

</div>

Hello,

I'm testing logstash 5.4.2 in my staging env and I've noticed that output of geoip plugins has changes. Instead of GeoJSON output, like I had in 5.4.1

```auto
    "location": [
      -122.3042,
      47.913
    ],

```

I now get a hash of lat / lon.

```auto
    "location": {
      "lat": 47.913,
      "lon": -122.3042
    },

```

My geoip configuration looks like this:

```auto
    geoip {
      source => ["src_ip"]
      fields => ["country_code2", "country_name", "latitude", "longitude", "location"]
    }

```

I looked at release notes and github history and didn't find where this changed.

Is this expected behaviour or did I do something wrong?

---

<div class="post-metadata">

### Author: ![matejzero](https://avatars.discourse-cdn.com/v4/letter/m/e9bcb4/32.png) [@matejzero](https://discuss.elastic.co/u/matejzero)
#### Post date: [June 29, 2017, 11:26am UTC](https://discuss.elastic.co/t/output-of-geoip-filter-changed-in-logstash-5-4-2-no-more-geojson/91186/2 "2017-06-29T11:26:03Z")

</div>

Looking as logstash differences between 5.4.1 and 5.4.2, I noticed geoip filter was updated from 4.0.4 to 4.1.1.

I'm looking at the geoip changelog, but I'm not good in ruby, so I'm not sure which part changes behaviour.

---

<div class="post-metadata">

### Author: ![matejzero](https://avatars.discourse-cdn.com/v4/letter/m/e9bcb4/32.png) [@matejzero](https://discuss.elastic.co/u/matejzero)
#### Post date: [June 29, 2017, 11:41am UTC](https://discuss.elastic.co/t/output-of-geoip-filter-changed-in-logstash-5-4-2-no-more-geojson/91186/3 "2017-06-29T11:41:44Z")

</div>

I think the problem is here: [https://github.com/logstash-plugins/logstash-filter-geoip/commit/ec18789d42302eebb3b775ad5c49fb9aba394d40#diff-0db10ce49673bb86356e5398c93ad8b3R257](https://github.com/logstash-plugins/logstash-filter-geoip/commit/ec18789d42302eebb3b775ad5c49fb9aba394d40#diff-0db10ce49673bb86356e5398c93ad8b3R257)

Logstash generates location hash here instead of an array, like GeoJSON should have.

Old code: [https://github.com/logstash-plugins/logstash-filter-geoip/commit/ec18789d42302eebb3b775ad5c49fb9aba394d40#diff-0ceaeedc6497c6d61fa5ae1d2db1dc58L212](https://github.com/logstash-plugins/logstash-filter-geoip/commit/ec18789d42302eebb3b775ad5c49fb9aba394d40#diff-0ceaeedc6497c6d61fa5ae1d2db1dc58L212)

---

<div class="post-metadata">

### Author: ![matejzero](https://avatars.discourse-cdn.com/v4/letter/m/e9bcb4/32.png) [@matejzero](https://discuss.elastic.co/u/matejzero)
#### Post date: [June 30, 2017, 10:01am UTC](https://discuss.elastic.co/t/output-of-geoip-filter-changed-in-logstash-5-4-2-no-more-geojson/91186/4 "2017-06-30T10:01:07Z")

</div>

I looked at ES documentation and saw that it can take hash as geopoint type as well: [https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/geo-point.html)

All is good.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 28, 2017, 10:14am UTC](https://discuss.elastic.co/t/output-of-geoip-filter-changed-in-logstash-5-4-2-no-more-geojson/91186/5 "2017-07-28T10:14:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.