Hi All, I'm having problems with PacketBeat dashboard not displaying Client Locations correctly, (see screenshot attached)- although saved search is returning results from query correctly.
Are you using Packetbeat and dashboards 1.x version? If yes, then in order to have GeoIP information, you need to load the GeoLite city database. For more information please check the documentation.
Thanks Monica, I've installed the GeoLity City database and enabled it in the configuration file /etc/packetbeat/packetbeat.yml but still got the same error 
How can i check the version of Dashboards?
Is Packetbeat printing any error/warning on the screen/logs? You can easier check for errors when starting Packetbeat in foreground:
./packetbeat -c packetbeat.yml -e
There is no error being printed when i start packetbeat using command prompt
Monica: as i have got the packetbeat installed on remote server pushing logs into kibana server- do i need to install GeoIP locally as well? (locally to the packetbeat)
Yes, if you are using Packetbeat 1.x versions, then you need to install GeoLite city database on the same server where Packetbeat is installed, as Packetbeat is adding the GeoIP information to the event. Also, please make sure you configure geoip.paths with the path to the GeoLite database.
thank you Monica, thats done now- I've installed GeoLiteCity.dat, will give it a minute to collect the data and see if can see the results in dashboard.
Cheers, Tomek
Monica, this is working perfectly now, please note that also maps in the kibana4 index.js needs to be updated with free maps from https://leaflet-extras.github.io/leaflet-providers/preview/index.html otherwise below will be load in the details:
This topic was automatically closed after 21 days. New replies are no longer allowed.