# Problems with geoip configuration **URL:** \ **Category:** Logstash\ **Created:** [September 7, 2015, 10:09am UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767 "2015-09-07T10:09:26Z")\ **Posts on this page:** 17\ **Page:** 2
**Author:** ![dfaropennetwork](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@dfaropennetwork](https://discuss.elastic.co/u/dfaropennetwork)\ **Post date:** [September 15, 2015, 10:50am UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/21 "2015-09-15T10:50:46Z")
where can i change for type to ip?? ``` "clientip" : { "type" : "string", "norms" : { "enabled" : false }, ``` thanks so much ---
**Author:** ![dfaropennetwork](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@dfaropennetwork](https://discuss.elastic.co/u/dfaropennetwork)\ **Post date:** [September 17, 2015, 12:20pm UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/22 "2015-09-17T12:20:13Z")
Hi warkolm, i have news: i finally created my own "index pattern", i have my template, and when logstash starting catch my template, i see that with the kopf plugin but my problem continues My geoip and client mappings: "geoip": { "dynamic": "true", "properties": { "location": { "doc\_values": true, "type": "geo\_point" }, "longitude": { "doc\_values": true, "type": "float" }, "latitude": { "doc\_values": true, "type": "float" }, "ip": { "doc\_values": true, "type": "ip" } } }, for client ip: "clientip": { "doc\_values": true, "type": "ip" }, I regenerated thel index and appears the new fields: this is my apache configuration for logstash filter { if [type] == "apache\_error" { grok { pattern =\> "%{COMBINEDAPACHELOG}" add\_field =\> ["received\_from", "%{host}"] } } } filter { if [type] == "apache\_access" { grok { match =\> {"message" =\> "%{COMBINEDAPACHELOG}" } } geoip { source =\> "clientip" target =\> "geoip" database =\> "/etc/logstash/GeoLiteCity.dat" add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ] add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ] } mutate { convert =\> ["[geoip][coordinates]", "float" ] } } } filter { if [type] == "apache\_access\_ssl" { grok { match =\> {"message" =\> "%{COMBINEDAPACHELOG}" } } geoip { source =\> "clientip" target =\> "geoip" database =\> "/etc/logstash/GeoLiteCity.dat" add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ] add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ] } mutate { convert =\> ["[geoip][coordinates]", "float" ] } } } and the output for logstash output { elasticsearch { host =\> "marioneto01" cluster =\> "oknels" protocol =\> "http" index =\> "okn-%{+YYYY.MM.dd}" template =\> "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.5-java/lib/logstash/outputs/elasticsearch/okn-template.json" template\_name =\> "okn-\*" manage\_template =\> "true" #template\_overwrite =\> "true" } stdout { codec =\> rubydebug } } ideas?? thanks ---
**Author:** ![raphaele](https://avatars.discourse-cdn.com/v4/letter/r/ecc23a/32.png) [@raphaele](https://discuss.elastic.co/u/raphaele)\ **Post date:** [October 27, 2015, 12:34pm UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/23 "2015-10-27T12:34:57Z")
What kind of IP addresses do you have in your log ? Geoip filter is not supposed to try to populate if the source is a private IP address. It only works on public address. Can you try with ip adress 8.8.8.8 and see if it works ? Moreover, the filter create a geoip object with latitude, longitude, etc... so all you need in your filter conf is geoip { source =\> "clientip" target =\> "geoip" database =\> "/etc/logstash/GeoLiteCity.dat" } and you don't need the mutate filter ---
**Author:** ![dfaropennetwork](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@dfaropennetwork](https://discuss.elastic.co/u/dfaropennetwork)\ **Post date:** [February 12, 2016, 5:21am UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/24 "2016-02-12T05:21:49Z")
I resolved all my problems with the new versions 2.x thanx so much ---
**Author:** ![dfaropennetwork](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@dfaropennetwork](https://discuss.elastic.co/u/dfaropennetwork)\ **Post date:** [March 18, 2016, 1:23am UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/25 "2016-03-18T01:23:53Z")
Go back the problems with the 2.2.1 versión ☹ ---
**Author:** ![zxey](https://avatars.discourse-cdn.com/v4/letter/z/bbce88/32.png) [@zxey](https://discuss.elastic.co/u/zxey)\ **Post date:** [July 31, 2016, 9:02am UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/26 "2016-07-31T09:02:00Z")
Anyone? Please help me!! Hi, I would like to create GeoIP visualisation in my Kibana. However, I can't even seem to find the geo\_point feld. What should I do? Im a noob here so pardon me if there are anyt im lacking of and I'm trying my hardest to get it done for my project. I am using Windows 2012 R2 on VMware workstation to do this. Elasticsearch: [https://download.elastic.co/elastic...p/elasticsearch/2.3.1/elasticsearch-2.3.1.zip](https://download.elastic.co/elastic...p/elasticsearch/2.3.1/elasticsearch-2.3.1.zip) Logstash: [https://download.elastic.co/logstash/logstash/logstash-2.3.1.zip](https://download.elastic.co/logstash/logstash/logstash-2.3.1.zip) Kibana: [https://download.elastic.co/kibana/kibana/kibana-4.5.0-windows.zip](https://download.elastic.co/kibana/kibana/kibana-4.5.0-windows.zip) Shippers: Filebeat: [https://download.elastic.co/beats/filebeat/filebeat-1.2.1-windows.zip](https://download.elastic.co/beats/filebeat/filebeat-1.2.1-windows.zip) Packetbeat: [https://download.elastic.co/beats/packetbeat/packetbeat-1.2.1-windows.zip](https://download.elastic.co/beats/packetbeat/packetbeat-1.2.1-windows.zip) Topbeat: [https://download.elastic.co/beats/topbeat/topbeat-1.2.1-windows.zip](https://download.elastic.co/beats/topbeat/topbeat-1.2.1-windows.zip) Winlogbeat: [https://download.elastic.co/beats/winlogbeat/winlogbeat-1.2.1-windows.zip](https://download.elastic.co/beats/winlogbeat/winlogbeat-1.2.1-windows.zip) ![](https://us1.discourse-cdn.com/elastic/original/2X/7/79cbe67877dabaffead13c0a2de0f58bc09b552f.png) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 31, 2016, 9:40am UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/27 "2016-07-31T09:40:31Z")
This is a very old thread. Please create a new one for you question. ---
**Author:** ![dfaropennetwork](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@dfaropennetwork](https://discuss.elastic.co/u/dfaropennetwork)\ **Post date:** [August 1, 2016, 11:13pm UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/28 "2016-08-01T23:13:11Z")
i've the same issue, i suppose that is for the mapping index ---
**Author:** ![Clement\_Ros](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/clement_ros/32/6198_2.png) [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)\ **Post date:** [August 19, 2016, 11:48am UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/29 "2016-08-19T11:48:43Z")
If i have understand your problem is just the map doesn't appear in kibana ? You must to go in your map visualisation, select the "WMS compliant map server", and edit the options like this : - WMS URL : [http://ows-tile.terrestris.de/osm-basemap/service](http://ows-tile.terrestris.de/osm-basemap/service)? - WMS Layers: OSM-WMS - WMS Version: 1.1.1 - WMS format: image/jpeg ![](https://us1.discourse-cdn.com/elastic/original/2X/b/b0454aeeb967aaffe8c592866b07512491114bf0.png) To have good colors you must unselect "Desaturate map tiles" ---
**Author:** ![dfaropennetwork](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@dfaropennetwork](https://discuss.elastic.co/u/dfaropennetwork)\ **Post date:** [August 25, 2016, 3:41am UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/30 "2016-08-25T03:41:41Z")
Great Clement so many thanks, now i see the map but my problems are in the geoip filter. ---
**Author:** ![Clement\_Ros](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/clement_ros/32/6198_2.png) [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)\ **Post date:** [August 25, 2016, 6:29am UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/31 "2016-08-25T06:29:33Z")
Can you show me your filter configuration please ? ---
**Author:** ![dfaropennetwork](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@dfaropennetwork](https://discuss.elastic.co/u/dfaropennetwork)\ **Post date:** [August 27, 2016, 2:08am UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/32 "2016-08-27T02:08:25Z")
Sure > filter { > if [type] == "apache\_access" { > grok { > match =\> {"message" =\> "%{COMBINEDAPACHELOG}" } > } > date { > match =\> ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"] > } > geoip { > source =\> "clientip" > database =\> "/usr/share/GeoIP/GeoLiteCity.dat" > } > } > } > filter { > if [type] == "apache\_access\_ssl" { > grok { > match =\> {"message" =\> "%{COMBINEDAPACHELOG}" } > } > date { > match =\> ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"] > } > geoip { > source =\> "clientip" > database =\> "/usr/share/GeoIP/GeoLiteCity.dat" > } > } > } > filter { > if [type] == "apache\_error" { > grok { > pattern =\> "%{COMBINEDAPACHELOG}" > add\_field =\> ["received\_from", "%{host}"] > } > } > date { > match =\> ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"] > } > geoip { > source =\> "clientip" > database =\> "/usr/share/GeoIP/GeoLiteCity.dat" > } > } > filter { > if [type] == "apache\_error\_ssl" { > grok { > pattern =\> "%{COMBINEDAPACHELOG}" > add\_field =\> ["received\_from", "%{host}"] > } > } > date { > match =\> ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"] > } > geoip { > source =\> "clientip" > database =\> "/usr/share/GeoIP/GeoLiteCity.dat" > } > } ---
**Author:** ![Clement\_Ros](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/clement_ros/32/6198_2.png) [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)\ **Post date:** [August 29, 2016, 6:45am UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/33 "2016-08-29T06:45:48Z")
Try with this configuration: > filter { > if "apache\_access" in [type] { > grok { > match =\> {"message" =\> "%{COMBINEDAPACHELOG}" } > } > date { > match =\> ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"] > } > geoip { > source =\> "clientip" > target =\> "geoip" > database =\> "/usr/share/GeoIP/GeoLiteCity.dat" > add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ] > add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ] > } > mutate { > convert =\> ["[geoip][coordinates]", "float"] > merge =\> { "[tags]" =\> "[fields][tags]" } > remove\_field =\> "[fields][tags]" > } > } > } > filter { > if "apache\_access\_ssl" in [type] { > grok { > match =\> {"message" =\> "%{COMBINEDAPACHELOG}" } > } > date { > match =\> ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"] > } > geoip { > source =\> "clientip" > target =\> "geoip" > database =\> "/usr/share/GeoIP/GeoLiteCity.dat" > add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ] > add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ] > } > mutate { > convert =\> ["[geoip][coordinates]", "float"] > merge =\> { "[tags]" =\> "[fields][tags]" } > remove\_field =\> "[fields][tags]" > } > } > } > filter { > if "apache\_error" in [type] { > grok { > pattern =\> "%{COMBINEDAPACHELOG}" > add\_field =\> ["received\_from", "%{host}"] > } > date { > match =\> ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"] > } > geoip { > source =\> "clientip" > target =\> "geoip" > database =\> "/usr/share/GeoIP/GeoLiteCity.dat" > add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ] > add\_field =\> ["[geoip][coordinates]", "%{[geoip][lati"] > } > mutate { > convert =\> ["[geoip][coordinates]", "float"] > merge =\> { "[tags]" =\> "[fields][tags]" } > remove\_field =\> "[fields][tags]" > } > } > } > filter { > if "apache\_error\_ssl" in [type] { > grok { > pattern =\> "%{COMBINEDAPACHELOG}" > add\_field =\> ["received\_from", "%{host}"] > } > date { > match =\> ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"] > } > geoip { > source =\> "clientip" > target =\> "geoip" > database =\> "/usr/share/GeoIP/GeoLiteCity.dat" > add\_field =\> ["[geoip][coordinates]", "%{eoip][longitude]}" ] > add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ] > } > mutate { > convert =\> ["[geip][coordinates]", "float"] > merge =\> { "[tags]" =\> "[fields][tags]" } > remove\_field =\> "[fields][tags]" > } > } > } ---
**Author:** ![jeraldsm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeraldsm/32/11005_2.png) [@jeraldsm](https://discuss.elastic.co/u/jeraldsm)\ **Post date:** [August 29, 2016, 10:16am UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/34 "2016-08-29T10:16:39Z")
I have an another problem, i can see the field, geoip.location however I see no map when i apply the visualisation. ![](https://us1.discourse-cdn.com/elastic/original/2X/9/999166484c384aba42e4dfdb9d55fba89abba9b1.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/9/98e186d1fe08000c674b0fc6460f572fda2081f2.png) Sample Log file `84.141.88.166 - - [29/Aug/2016:10:56:47 +0200] store.abc.de "GET /searchAsYouType.action?term=afs35 HTTP/1.1" 200 176 "V8P4zwoyM@sAACuuVy0AAAII" "https://store.abc.de/b2bOrderHistoryTab.action" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0" 391575 1B047AA8C7BD127FB6103AE2F7C462B8` Further more all the field gets values clearly but I could not get the MAP! ![](https://us1.discourse-cdn.com/elastic/original/2X/2/2bc1d35cb6f4980b374ae4b0a3e09172456fd7f0.png) My Logstash ConfiguratioN: > ``` > # Analyze geo location > if [client_ip] { > geoip { > source => "client_ip" > target => "client_geoip" > #database => "/jsm/logstash/GeoLiteCity.dat" > #add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ] > #add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ] > } > mutate { > convert => ["[geoip][coordinates]", "float"] > } > > if ("_grokparsefailure" in [tags]) { > mutate { > add_tag => ["geoip_parsefailure"] > remove_tag => ["_grokparsefailure"] > } > } > } > > ``` ---
**Author:** ![fei](https://avatars.discourse-cdn.com/v4/letter/f/59ef9b/32.png) [@fei](https://discuss.elastic.co/u/fei)\ **Post date:** [January 13, 2017, 6:54pm UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/36 "2017-01-13T18:54:32Z")
I have posted some founding here: [https://autofei.wordpress.com/2017/01/11/visualize-geo-location-of-log-using-elasticsearch-logstash-kibana/](https://autofei.wordpress.com/2017/01/11/visualize-geo-location-of-log-using-elasticsearch-logstash-kibana/) But I don't quite get is why the Kibana hard code the "Geohash -\> geoip.location" in the UI. Is there a way to change it based on your template? Thanks! ---
**Author:** ![mhalatuituia](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\ **Post date:** [February 5, 2017, 9:12pm UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/37 "2017-02-05T21:12:28Z")
Hi there would you kindly do the same config for bind dns logging as i see you did it here for apahe ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:28am UTC](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767/38 "2017-07-06T04:28:54Z")
Closed on July 6, 2017, 4:28am UTC [Previous page](https://discuss.elastic.co/t/problems-with-geoip-configuration/28767.md?page=1)