# Pipeline+geoip

**URL:** <https://discuss.elastic.co/t/pipeline-geoip/255665>\
**Category:** Вопросы на русском языке\
**Created:** [November 17, 2020, 10:42am UTC](https://discuss.elastic.co/t/pipeline-geoip/255665 "2020-11-17T10:42:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![es7x](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@es7x](https://discuss.elastic.co/u/es7x)\
**Post date:** [November 17, 2020, 10:42am UTC](https://discuss.elastic.co/t/pipeline-geoip/255665/1 "2020-11-17T10:42:38Z")

</div>

Не могу сообразить, почему не обрабатывается geoip в pipeline.?

Есть стандартный `filebeat-7.10.0-haproxy-log-pipeline`

в нем присутствует geoip processorы

```auto
       "geoip" : {
          "field" : "source.ip",
          "target_field" : "source.geo",
          "ignore_missing" : true
        }
      }

```

выполняю симуляцию pipeline

```auto
POST _ingest/pipeline/filebeat-7.10.0-haproxy-log-pipeline/_simulate
{
  "docs": [
      { "_source": 
          { "message" : "Nov 16 16:15:24 localhost haproxy[95249]: 10.21.254.31:56351 [16/Nov/2020:16:15:24.149] rmq-tr-ampq rmq-tr-ampq/rmq-c-tr 1/0/19 594 -- 947/178/177/64/0 0/0"
          }
      }
    ]
}

```

Вывод:

```auto
{
  "docs" : [
    {
      "doc" : {
        "_index" : "_index",
        "_type" : "_doc",
        "_id" : "_id",
        "_source" : {
          "temp" : { },
          "process" : {
            "name" : "haproxy",
            "pid" : 95249
          },
          "@timestamp" : "2020-11-16T16:15:24.149Z",
          "related" : {
            "ip" : [
              "10.21.254.31"
            ]
          },
          "haproxy" : {
            "backend_queue" : 0,
            "server_name" : "rmq-c-tr",
            "total_waiting_time_ms" : 1,
            "termination_state" : "--",
            "connection_wait_time_ms" : 0,
            "backend_name" : "rmq-tr-ampq",
            "frontend_name" : "rmq-tr-ampq",
            "server_queue" : 0,
            "bytes_read" : 594,
            "source" : "localhost",
            "connections" : {
              "retries" : 0,
              "server" : 64,
              "active" : 947,
              "backend" : 177,
              "frontend" : 178
            }
          },
          "source" : {
            "port" : 56351,
            "address" : "10.21.254.31",
            "ip" : "10.21.254.31"
          },
          "event" : {
            "duration" : 19000000,
            "ingested" : "2020-11-17T10:37:37.350003075Z",
            "kind" : "event"
          }
        },
        "_ingest" : {
          "timestamp" : "2020-11-17T10:37:37.350003075Z"
        }
      }
    }
  ]
}

```

Видно, что не какие процессоры с гео не выполняются + так же и ctx не отрабатывает. Куда копать не ясно.

---

<div class="post-metadata">

**Author:** ![Slavik\_Fursov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/slavik_fursov/32/48975_2.png) [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\
**Post date:** [November 17, 2020, 6:58pm UTC](https://discuss.elastic.co/t/pipeline-geoip/255665/2 "2020-11-17T18:58:29Z")

</div>

не знаю если дело именно в этом, но для IP 10.21.254.31 гео-декодинга не существует, так как это "reserved (private) IP address".

---

<div class="post-metadata">

**Author:** ![es7x](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@es7x](https://discuss.elastic.co/u/es7x)\
**Post date:** [November 19, 2020, 8:24am UTC](https://discuss.elastic.co/t/pipeline-geoip/255665/3 "2020-11-19T08:24:57Z")

</div>

Да, Вы правы, спасибо!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2020, 8:25am UTC](https://discuss.elastic.co/t/pipeline-geoip/255665/4 "2020-12-17T08:25:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.