# TileMap, GeoIP for RFC1918 addresses

**URL:** <https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247>\
**Category:** Logstash\
**Created:** [August 17, 2016, 11:35am UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247 "2016-08-17T11:35:33Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\
**Post date:** [August 17, 2016, 9:12pm UTC](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247/3 "2016-08-17T21:12:08Z")

</div>

geoip {

```
     source => "client_address"
     target => "geoip"
     database => "/etc/logstash/conf.d/geo/GeoLiteCity.dat"
     add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
     add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]

        if [client_address] =~ /^10\./ {
           mutate { replace => { "[geoip][timezone]" => "Pacific/Auckland" } }
           mutate { replace => { "[geoip][country_name]" => "University of Otago" } }
           mutate { replace => { "[geoip][country_code2]" => "UO" } }
           mutate { replace => { "[geoip][country_code3]" => "UoO" } }
           mutate { remove_field => ["[geoip][location]" ] }
           mutate { add_field => { "[geoip][location]" => "170.525" } }
           mutate { add_field => { "[geoip][location]" => "-45.865" } }
           mutate { convert => ["[geoip][location]", "float" ] }
           mutate { replace => ["[geoip][latitude]", -45.856 ] }
           mutate { convert => ["[geoip][latitude]", "float" ] }
           mutate { replace => ["[geoip][longitude]", 170.525 ] }
           mutate { convert => ["[geoip][longitude]", "float" ] }
        }

     }

```

Dosen't work:

> ```
> The given configuration is invalid. Reason: Expected one of #, => at line 34, column 8 (byte 2419) after filter {
> if [type] == "syslog" {
> syslog_pri { }
> date {
> match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
> }
> mutate {
> replace => ["host", "%{logsource}"]
> 
> ```

> ```
> }
> if [program] == "accesslog-elastic" {
> grok {
> patterns_dir => ["/etc/logstash/conf.d/patterns"]
> match => [
> "message" ,"%{WORD:message_type}: %{NUMBER:log_time} %{NUMBER:duration} %{IP:client_address} %{WORD:transaction_result_code}/%{NUMBER:http_result_code} %{NUMBER:bytes:int} %{WORD:http_metod} %{PROTOCOL:url_protocol}%{DOMAIN:url_domain}%{REFERER:url_referer} %{NOTSPACE:user} %{NOTSPACE:requested_server} %{NOTSPACE:response_mime_type} %{NOT_HYPHEN:acl_decision_tag}-%{NOT_HYPHEN:access_or_decryption_policy}-%{NOT_HYPHEN:identity_policy_group}-%{NOT_HYPHEN:outbound_maleware_scanning_policy_group}-%{NOT_HYPHEN:data_security_policy_group}-%{NOT_HYPHEN:external_dlp_policy_group}-%{NOT_HYPHEN:routing_policy_group} <%{NOT_COMMA:url_category},%{NOT_COMMA:wbrs},%{NOT_COMMA:webroot_verdict},%{NOT_COMMA:spyname},%{NOT_COMMA:trr},%{NOT_COMMA:threat_id},%{NOT_COMMA:trace_id},%{NOT_COMMA:mcafee_verdict},%{NOT_COMMA:mcafee_filenmae},%{NOT_COMMA:mcafee_scan_error_code},%{NOT_COMMA:mcafee_detection_type},%{NOT_COMMA:mcafee_virus_type},%{NOT_COMMA:mcafee_virus_name},%{NOT_COMMA:sophos_verdict},%{NOT_COMMA:sophos_scan_return_code},%{NOT_COMMA:sophos_file_location},%{NOT_COMMA:sophos_threat_name},%{NOT_COMMA:data_security},%{NOT_COMMA:data_loss_prevention},%{NOT_COMMA:requested_side_url_verdict},%{NOT_COMMA:response_side_url_verdict},%{NOT_COMMA:unified_inbound_dvs_verdict},%{NOT_COMMA:web_reputation_filter_type},%{NOT_COMMA:avc_application_name},%{NOT_COMMA:avc_application_type},%{NOT_COMMA:avc_application_behavior},%{NOT_COMMA:avc_safe_browsing_scanning_verdict},%{NOT_COMMA:average_bandwidth},%{NOT_COMMA:throttle_flag},%{NOT_COMMA:type_of_user},%{NOT_COMMA:unified_outbound_dvs_verdict},%{NOT_COMMA:outbound_threat_name}%{GREEDYDATA:message_body}>"
> ]
> }
> 
> ```

> ```
> mutate {
> #convert => ["bytes", "integer"]
> #convert => ["duration", "integer"]
> #convert => ["client_address", "ip"]
> }
> 
> ```

> ```
> geoip {
> 
> ```

> ```
> source => "client_address"
> target => "geoip"
> database => "/etc/logstash/conf.d/geo/GeoLiteCity.dat"
> add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
> add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
> 
> ```

> ```
> if {:level=>:fatal}
> 
> ```

---

_[View the full topic](https://discuss.elastic.co/t/tilemap-geoip-for-rfc1918-addresses/58247)._