# There no grok ,geoip information
**URL:** https://discuss.elastic.co/t/there-no-grok-geoip-information/95636
**Category:** Logstash
**Created:** [August 3, 2017, 3:58am UTC](https://discuss.elastic.co/t/there-no-grok-geoip-information/95636 "2017-08-03T03:58:23Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Joe\_Yang](https://discuss.elastic.co/u/Joe_Yang)
#### Post date: [August 3, 2017, 3:58am UTC](https://discuss.elastic.co/t/there-no-grok-geoip-information/95636/1 "2017-08-03T03:58:23Z")
We followed this link to configure elasticsearch, filebeat and logslash([https://www.elastic.co/guide/en/logstash/5.4/advanced-pipeline.html](https://www.elastic.co/guide/en/logstash/5.4/advanced-pipeline.html)), but there's no ip and geo information after running curl as follows, any advice would be appreciated:
$curl -XGET 'localhost:9200/filebeat-2017.08.03/\_search?pretty&q=response=200'
{
"took" : 5,
"timed\_out" : false,
"\_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 98,
"max\_score" : 2.6682286,
"hits" : [
{
"\_index" : "filebeat-2017.08.03",
"\_type" : "doc",
"\_id" : "AV2l5-Qn6HWgZDLXJmSK",
"\_score" : 2.6682286,
"\_source" : {
"@timestamp" : "2017-08-03T02:23:38.010Z",
"beat" : {
"hostname" : "164mysqlmove",
"name" : "164mysqlmove",
"version" : "5.5.1"
},
"input\_type" : "log",
"message" : "83.149.9.216 - - [04/Jan/2015:05:13:45 +0000] "GET /presentations/logstash-monitorama-2013/images/frontend-response-codes.png HTTP/1.1" 200 52878 "[http://semicomplete.com/presentations/logstash-monitorama-2013/](http://semicomplete.com/presentations/logstash-monitorama-2013/)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_9\_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36"",
"offset" : 2932,
"source" : "/home/mysqlmove/logstash-5.5.1/logstash-tutorial.log",
"type" : "log"
}
$ curl -XGET 'localhost:9200/filebeat-2017.08.03/\_search?pretty&q=geoip.city\_name=Buffalo'
{
"took" : 22,
"timed\_out" : false,
"\_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 0,
"max\_score" : null,
"hits" : []
}
}
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 3, 2017, 4:17am UTC](https://discuss.elastic.co/t/there-no-grok-geoip-information/95636/2 "2017-08-03T04:17:11Z")
So you setup the filebeat and logstash configs?
---
### Author:  [@Joe\_Yang](https://discuss.elastic.co/u/Joe_Yang)
#### Post date: [August 3, 2017, 6:03am UTC](https://discuss.elastic.co/t/there-no-grok-geoip-information/95636/3 "2017-08-03T06:03:56Z")
yes, but there's no ip and geo info. from the output ...
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 3, 2017, 8:54am UTC](https://discuss.elastic.co/t/there-no-grok-geoip-information/95636/4 "2017-08-03T08:54:16Z")
What's the output from Logstash then?
Can you "GET" a single doc and show the entire thing?
---
### Author:  [@Joe\_Yang](https://discuss.elastic.co/u/Joe_Yang)
#### Post date: [August 3, 2017, 10:05am UTC](https://discuss.elastic.co/t/there-no-grok-geoip-information/95636/5 "2017-08-03T10:05:52Z")
Thanks for your prompt response, could you paste a command on How to “GET” a single doc ?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 3, 2017, 10:09am UTC](https://discuss.elastic.co/t/there-no-grok-geoip-information/95636/6 "2017-08-03T10:09:59Z")
`curl -XGET localhost:9200/filebeat-2017.08.03/doc/AV2l5-Qn6HWgZDLXJmSK`
---
### Author:  [@Joe\_Yang](https://discuss.elastic.co/u/Joe_Yang)
#### Post date: [August 4, 2017, 2:24pm UTC](https://discuss.elastic.co/t/there-no-grok-geoip-information/95636/7 "2017-08-04T14:24:25Z")
> [@warkolm](#):
>
> curl -XGET localhost:9200/filebeat-2017.08.03/doc/AV2l5-Qn6HWgZDLXJmSK
curl -XGET localhost:9200/filebeat-2017.08.03/doc/AV2l5-Qn6HWgZDLXJmSK
{"\_index":"filebeat-2017.08.03","\_type":"doc","\_id":"AV2l5-Qn6HWgZDLXJmSK","\_version":1,"found":true,"\_source":{"@timestamp":"2017-08-03T02:23:38.010Z","beat":{"hostname":"164mysqlmove","name":"164mysqlmove","version":"5.5.1"},"input\_type":"log","message":"83.149.9.216 - - [04/Jan/2015:05:13:45 +0000] "GET /presentations/logstash-monitorama-2013/images/frontend-response-codes.png HTTP/1.1" 200 52878 "[http://semicomplete.com/presentations/logstash-monitorama-2013/\](http://semicomplete.com/presentations/logstash-monitorama-2013/%5C)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_9\_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36"","offset":2932,"source":"/home/mysqlmove/logstash-5.5.1/logstash-tutorial.log","type":"log"}}mysqlmove@164mysqlmove:~/logstash-5.5.1$
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 4, 2017, 10:48pm UTC](https://discuss.elastic.co/t/there-no-grok-geoip-information/95636/8 "2017-08-04T22:48:24Z")
Try adding `?pretty` to the end, it'll make it easier to read.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 1, 2017, 10:48pm UTC](https://discuss.elastic.co/t/there-no-grok-geoip-information/95636/9 "2017-09-01T22:48:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.