# Possible to use GeoIP without Filebeat shipping logs?

**URL:** <https://discuss.elastic.co/t/possible-to-use-geoip-without-filebeat-shipping-logs/140607>\
**Category:** Elasticsearch\
**Created:** [July 18, 2018, 6:41pm UTC](https://discuss.elastic.co/t/possible-to-use-geoip-without-filebeat-shipping-logs/140607 "2018-07-18T18:41:38Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![brolo](https://avatars.discourse-cdn.com/v4/letter/b/e8c25b/32.png) [@brolo](https://discuss.elastic.co/u/brolo)\
**Post date:** [July 18, 2018, 6:41pm UTC](https://discuss.elastic.co/t/possible-to-use-geoip-without-filebeat-shipping-logs/140607/1 "2018-07-18T18:41:38Z")

</div>

I am working on adding logging functionality to an internal tool used as a build environment manager/build orchestrator. I am currently sending data to ES by formatting a JSON with relevant data and using a POST request directly to the ES index containing the JSON. We would like to correlate build times with geographic locations to understand how distance from our servers affects these times. Is there anyway to leverage the GeoIP plugin without using Filebeat to ship logs?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 18, 2018, 8:57pm UTC](https://discuss.elastic.co/t/possible-to-use-geoip-without-filebeat-shipping-logs/140607/2 "2018-07-18T20:57:05Z")

</div>

If you use an ingest pipeline that has it defined you can, the data doesn't have to be sent via beats, it just has to go via the API 🙂

---

<div class="post-metadata">

**Author:** ![brolo](https://avatars.discourse-cdn.com/v4/letter/b/e8c25b/32.png) [@brolo](https://discuss.elastic.co/u/brolo)\
**Post date:** [July 19, 2018, 5:54pm UTC](https://discuss.elastic.co/t/possible-to-use-geoip-without-filebeat-shipping-logs/140607/3 "2018-07-19T17:54:45Z")

</div>

So I made an ingest pipeline like this:

```auto
{
    "description": "Pipeline for parsing IP for location info",
    "processors": [
        {
          "geoip": {
            "field": "ip"
          }
        }
    ]
}

```

I attempt a POST like this:

```auto
curl -XPOST 'ES_HOST:ES_PORT/test_index/test_type/test_id?pipeline=location-pipeline' -H 'Content-Type: application/json' -d '{
 "ip": "8.8.0.0"
}'

```

My data gets through to ES and I am able to see it in Kibana, but my `_id` field is static and new entries just replace the previous one. Is there a different way of going about this?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 19, 2018, 9:49pm UTC](https://discuss.elastic.co/t/possible-to-use-geoip-without-filebeat-shipping-logs/140607/4 "2018-07-19T21:49:54Z")

</div>

Are all the entries the same?

---

<div class="post-metadata">

**Author:** ![brolo](https://avatars.discourse-cdn.com/v4/letter/b/e8c25b/32.png) [@brolo](https://discuss.elastic.co/u/brolo)\
**Post date:** [July 20, 2018, 1:25pm UTC](https://discuss.elastic.co/t/possible-to-use-geoip-without-filebeat-shipping-logs/140607/5 "2018-07-20T13:25:30Z")

</div>

Not sure what you mean by that. When I XPOST the json containing the IP, I switched the IP so I can tell what happens. If I send 8.8.8.8 followed by 9.9.9.9, the 8.8.8.8 entry in Kibana gets replaced with the 9.9.9.9 because the \_id is `test_id`. I'm not sure how to get around this, considering that Filebeat usually creates a unique ID when sending directly to an index. Is there any other way to post directly to a pipeline without specifying the \_id?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 20, 2018, 9:31pm UTC](https://discuss.elastic.co/t/possible-to-use-geoip-without-filebeat-shipping-logs/140607/6 "2018-07-20T21:31:23Z")

</div>

> [@brolo](#):
>
> When I XPOST the json containing the IP, I switched the IP so I can tell what happens. If I send 8.8.8.8 followed by 9.9.9.9, the 8.8.8.8 entry in Kibana gets replaced with the 9.9.9.9 because the \_id is `test_id` .

Right, but did you change any of

> [@brolo](#):
>
> test\_index/test\_type/test\_id

?

If not, then it will overwrite as you are specifying the same document `_id`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2018, 9:34pm UTC](https://discuss.elastic.co/t/possible-to-use-geoip-without-filebeat-shipping-logs/140607/7 "2018-08-17T21:34:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.