# TileMap, GeoIP for RFC1918 addresses

**URL:** <https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247>\
**Category:** Logstash\
**Created:** [August 17, 2016, 11:35am UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247 "2016-08-17T11:35:33Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\
**Post date:** [August 17, 2016, 11:35am UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/1 "2016-08-17T11:35:33Z")

</div>

Hi Community,

looking for an opportunity to locate rfc1918 addresses to a tile map.

Non-rfc1918 works fine via GeoIP Database:

```
geoip {
         source => "client_address"
         target => "geoip"
         database => "/etc/logstash/conf.d/geo/GeoLiteCity.dat"
         add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
         add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
         }

      mutate {
         convert => ["[geoip][coordinates]", "float"]
         }

```

Is it possible to catch specific rfc1918 addresses and manipulate with specififc latitude, lontidtude -\> geo\_hash values.

Or add rfc1918 addresses to GeoLiteCity.dat ?

Thank you

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 17, 2016, 7:31pm UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/2 "2016-08-17T19:31:40Z")

</div>

> [@bastianhoss](#):
>
> rfc1918

You may want to explain what that is.

Have a look at [Creating geoip data for internal networks](https://discuss.elastic.co/t/creating-geoip-data-for-internal-networks/729)

---

<div class="post-metadata">

**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\
**Post date:** [August 17, 2016, 9:12pm UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/3 "2016-08-17T21:12:08Z")

</div>

geoip {

```
     source => "client_address"
     target => "geoip"
     database => "/etc/logstash/conf.d/geo/GeoLiteCity.dat"
     add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
     add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]

        if [client_address] =~ /^10\./ {
           mutate { replace => { "[geoip][timezone]" => "Pacific/Auckland" } }
           mutate { replace => { "[geoip][country_name]" => "University of Otago" } }
           mutate { replace => { "[geoip][country_code2]" => "UO" } }
           mutate { replace => { "[geoip][country_code3]" => "UoO" } }
           mutate { remove_field => ["[geoip][location]" ] }
           mutate { add_field => { "[geoip][location]" => "170.525" } }
           mutate { add_field => { "[geoip][location]" => "-45.865" } }
           mutate { convert => ["[geoip][location]", "float" ] }
           mutate { replace => ["[geoip][latitude]", -45.856 ] }
           mutate { convert => ["[geoip][latitude]", "float" ] }
           mutate { replace => ["[geoip][longitude]", 170.525 ] }
           mutate { convert => ["[geoip][longitude]", "float" ] }
        }

     }

```

Dosen't work:

> ```
> The given configuration is invalid. Reason: Expected one of #, => at line 34, column 8 (byte 2419) after filter {
> if [type] == "syslog" {
> syslog_pri { }
> date {
> match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
> }
> mutate {
> replace => ["host", "%{logsource}"]
> 
> ```

> ```
> }
> if [program] == "accesslog-elastic" {
> grok {
> patterns_dir => ["/etc/logstash/conf.d/patterns"]
> match => [
> "message" ,"%{WORD:message_type}: %{NUMBER:log_time} %{NUMBER:duration} %{IP:client_address} %{WORD:transaction_result_code}/%{NUMBER:http_result_code} %{NUMBER:bytes:int} %{WORD:http_metod} %{PROTOCOL:url_protocol}%{DOMAIN:url_domain}%{REFERER:url_referer} %{NOTSPACE:user} %{NOTSPACE:requested_server} %{NOTSPACE:response_mime_type} %{NOT_HYPHEN:acl_decision_tag}-%{NOT_HYPHEN:access_or_decryption_policy}-%{NOT_HYPHEN:identity_policy_group}-%{NOT_HYPHEN:outbound_maleware_scanning_policy_group}-%{NOT_HYPHEN:data_security_policy_group}-%{NOT_HYPHEN:external_dlp_policy_group}-%{NOT_HYPHEN:routing_policy_group} <%{NOT_COMMA:url_category},%{NOT_COMMA:wbrs},%{NOT_COMMA:webroot_verdict},%{NOT_COMMA:spyname},%{NOT_COMMA:trr},%{NOT_COMMA:threat_id},%{NOT_COMMA:trace_id},%{NOT_COMMA:mcafee_verdict},%{NOT_COMMA:mcafee_filenmae},%{NOT_COMMA:mcafee_scan_error_code},%{NOT_COMMA:mcafee_detection_type},%{NOT_COMMA:mcafee_virus_type},%{NOT_COMMA:mcafee_virus_name},%{NOT_COMMA:sophos_verdict},%{NOT_COMMA:sophos_scan_return_code},%{NOT_COMMA:sophos_file_location},%{NOT_COMMA:sophos_threat_name},%{NOT_COMMA:data_security},%{NOT_COMMA:data_loss_prevention},%{NOT_COMMA:requested_side_url_verdict},%{NOT_COMMA:response_side_url_verdict},%{NOT_COMMA:unified_inbound_dvs_verdict},%{NOT_COMMA:web_reputation_filter_type},%{NOT_COMMA:avc_application_name},%{NOT_COMMA:avc_application_type},%{NOT_COMMA:avc_application_behavior},%{NOT_COMMA:avc_safe_browsing_scanning_verdict},%{NOT_COMMA:average_bandwidth},%{NOT_COMMA:throttle_flag},%{NOT_COMMA:type_of_user},%{NOT_COMMA:unified_outbound_dvs_verdict},%{NOT_COMMA:outbound_threat_name}%{GREEDYDATA:message_body}>"
> ]
> }
> 
> ```

> ```
> mutate {
> #convert => ["bytes", "integer"]
> #convert => ["duration", "integer"]
> #convert => ["client_address", "ip"]
> }
> 
> ```

> ```
> geoip {
> 
> ```

> ```
> source => "client_address"
> target => "geoip"
> database => "/etc/logstash/conf.d/geo/GeoLiteCity.dat"
> add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
> add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
> 
> ```

> ```
> if {:level=>:fatal}
> 
> ```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 17, 2016, 9:13pm UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/4 "2016-08-17T21:13:51Z")

</div>

Please format your code with the `</>` button, it’s very hard to read.

---

<div class="post-metadata">

**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\
**Post date:** [August 17, 2016, 9:15pm UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/5 "2016-08-17T21:15:25Z")

</div>

Ok. Done.

---

<div class="post-metadata">

**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\
**Post date:** [August 17, 2016, 9:16pm UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/6 "2016-08-17T21:16:16Z")

</div>

RFC1918 is the Request for comment of private IPv4 addresses...

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 18, 2016, 9:09am UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/7 "2016-08-18T09:09:37Z")

</div>

You can not have conditionals with a filter, which is why it is complaining about the configuration being invalid.

---

<div class="post-metadata">

**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\
**Post date:** [August 18, 2016, 9:29am UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/8 "2016-08-18T09:29:27Z")

</div>

And how does : [Creating geoip data for internal networks](https://discuss.elastic.co/t/creating-geoip-data-for-internal-networks/729/3) works ?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 18, 2016, 9:46am UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/9 "2016-08-18T09:46:08Z")

</div>

You need to put the filters within the conditionals. If you identify the IP starts with an internal prefix, run your mutate filters and if this is not the case run the geoip filter.

---

<div class="post-metadata">

**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\
**Post date:** [August 18, 2016, 9:53am UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/10 "2016-08-18T09:53:34Z")

</div>

Please show me the an examlpe of this config...

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 18, 2016, 10:11am UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/11 "2016-08-18T10:11:05Z")

</div>

Something like this:

```
if [client_address] =~ /^10\./ {
  mutate {}
} else {
  geoip {}
}

```

There is more on conditionals [here](https://www.elastic.co/guide/en/logstash/2.3/event-dependent-configuration.html#conditionals).

---

<div class="post-metadata">

**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\
**Post date:** [August 18, 2016, 8:43pm UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/12 "2016-08-18T20:43:08Z")

</div>

Works fine! Thank you!🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:42am UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/13 "2017-07-06T04:42:41Z")

</div>