# Packetbeat 7.1 and Geoip setup **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [May 23, 2019, 7:29pm UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510 "2019-05-23T19:29:16Z")\ **Posts on this page:** 13\ **Page:** 2
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [May 28, 2019, 2:00pm UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510/21 "2019-05-28T14:00:17Z")
From looking at the 2 files can you determine What I have wrong? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 28, 2019, 8:58pm UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510/22 "2019-05-28T20:58:45Z")
Nope, there doesn't seem to be any geoip info in there which is unusual. ---
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [May 28, 2019, 9:20pm UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510/23 "2019-05-28T21:20:18Z")
What is the next step? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 28, 2019, 10:31pm UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510/24 "2019-05-28T22:31:45Z")
I'll see if I can get someone a bit more knowledgable involved 🙂 ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 28, 2019, 10:59pm UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510/25 "2019-05-28T22:59:55Z")
@Marcell0e > [@Marcell0e](#): > > "source": { "port": 62604, "bytes": 540534247, "ip": "10.3.200.80", "packets": 407607, "mac": "00:50:56:ab:e3:53" }, > [@Marcell0e](#): > > "destination": { "port": 9200, "bytes": 20035725, "ip": "10.3.200.25", "packets": 107149, "mac": "00:50:56:ab:be:5b" }, The source and destination IPs in the document you provided belong to private networks, thus the `geoip` processor using the default database cannot add geolocation for them. Can you check with public internet IPs? ---
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [May 29, 2019, 6:33pm UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510/26 "2019-05-29T18:33:20Z")
Is there away to map these IPs to a location of my choosing? Every post i have read they are using Logstash. I'm not using Logstash. I'm still trying to figure out Elasticsearch. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 30, 2019, 7:16am UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510/27 "2019-05-30T07:16:40Z")
I think the process would be similar as with Logstash. Create your custom `mmdb` database, put it in the directory that Elasticsearch expects it (`elasticsearch/modules/geo-ip`). Here's some article on how to create an mmdb: [https://blog.maxmind.com/2015/09/29/building-your-own-mmdb-database-for-fun-and-profit/](https://blog.maxmind.com/2015/09/29/building-your-own-mmdb-database-for-fun-and-profit/) ---
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [May 30, 2019, 11:49am UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510/28 "2019-05-30T11:49:43Z")
Will Elasticsearch be able to use both mmdb database to find IPs or just 1? ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 30, 2019, 12:22pm UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510/29 "2019-05-30T12:22:30Z")
One Geoip processor instance can only read from a single database. That gives you two options: - Create a new database that has your custom IPs plus the contents of the default database (I don't know how to do it or if it's possible at all, as I never worked with MMDB files myself). - In your ingest pipeline, have 2 geoip processors for every field you want populated (`source.geo`, `destination.geo`). The second one contains an `if` condition so that it executes only if the first one didn't populate the target field (`"if": "ctx?.source?.geo == null"`). ---
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [June 3, 2019, 4:00pm UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510/30 "2019-06-03T16:00:06Z")
How would I go about setting up your second suggestion? ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [June 3, 2019, 5:28pm UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510/31 "2019-06-03T17:28:18Z")
You have your original batch of processors: ```auto { "geoip": { "field": "client.ip", "target_field": "client.geo", "ignore_missing": true } }, { "geoip": { "field": "source.ip", "target_field": "source.geo", "ignore_missing": true } }, { "geoip": { "field": "destination.ip", "target_field": "destination.geo", "ignore_missing": true } }, { "geoip": { "field": "server.ip", "target_field": "server.geo", "ignore_missing": true } }, { "geoip": { "field": "host.ip", "target_field": "host.geo", "ignore_missing": true } }, ``` and them the same with your custom database and a condition to populate only missing fields: ```auto { "geoip": { "field": "client.ip", "target_field": "client.geo", "ignore_missing": true, "database_file": "my_custom.mmdb", "if": "ctx?.client?.geo == null" } }, { "geoip": { "field": "source.ip", "target_field": "source.geo", "ignore_missing": true, "database_file": "my_custom.mmdb", "if": "ctx?.source?.geo == null" } }, { "geoip": { "field": "destination.ip", "target_field": "destination.geo", "ignore_missing": true, "database_file": "my_custom.mmdb", "if": "ctx?.destination?.geo == null" } }, { "geoip": { "field": "server.ip", "target_field": "server.geo", "ignore_missing": true, "database_file": "my_custom.mmdb", "if": "ctx?.server?.geo == null" } }, { "geoip": { "field": "host.ip", "target_field": "host.geo", "ignore_missing": true, "database_file": "my_custom.mmdb", "if": "ctx?.host?.geo == null" } } ``` Warning: untested ---
**Author:** ![Marcell0e](https://avatars.discourse-cdn.com/v4/letter/m/ebca7d/32.png) [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Post date:** [June 3, 2019, 5:32pm UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510/32 "2019-06-03T17:32:25Z")
Would this be easier than creating a new MMDb? [Creating geoip data for internal networks](https://discuss.elastic.co/t/creating-geoip-data-for-internal-networks/729/2) Is this possible? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 1, 2019, 5:32pm UTC](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510/33 "2019-07-01T17:32:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/packetbeat-7-1-and-geoip-setup/182510.md?page=1)