# Type of data/logs to start with Elastic GEO capabilities

**URL:** <https://discuss.elastic.co/t/type-of-data-logs-to-start-with-elastic-geo-capabilities/195086>\
**Category:** Elasticsearch\
**Created:** [August 13, 2019, 7:15pm UTC](https://discuss.elastic.co/t/type-of-data-logs-to-start-with-elastic-geo-capabilities/195086 "2019-08-13T19:15:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rosho](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rosho/32/51872_2.png) [@Rosho](https://discuss.elastic.co/u/Rosho)\
**Post date:** [August 13, 2019, 7:15pm UTC](https://discuss.elastic.co/t/type-of-data-logs-to-start-with-elastic-geo-capabilities/195086/1 "2019-08-13T19:15:47Z")

</div>

Hi

I want to test the GEO capabilities of Elastic.  
If my logs do not have any "geo\_ coordinates", does that mean that I cannot test the GEO capabilities? Is it possible to add the geo coordinates (or other type of GEO) manually?

What type of logs/data do I need to have?  
I am attaching an example of my logs.

Thank you in advance

 ![log](https://us1.discourse-cdn.com/elastic/original/3X/d/b/dbb48a7c3b928994342d8f35e1b120a62732afdd.png)

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 14, 2019, 7:43am UTC](https://discuss.elastic.co/t/type-of-data-logs-to-start-with-elastic-geo-capabilities/195086/2 "2019-08-14T07:43:59Z")

</div>

hey,

you can use the [geoip processor](https://www.elastic.co/guide/en/elasticsearch/reference/7.3/geoip-processor.html) to look up information about the ip address. This includes information like country, state or city (depending on granularity of the available information). As those are text strings used for the enrichment, there is no need for geo based datatypes like a point or a shape.

Would that be sufficient for you?

--Alex

---

<div class="post-metadata">

**Author:** ![Rosho](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rosho/32/51872_2.png) [@Rosho](https://discuss.elastic.co/u/Rosho)\
**Post date:** [August 15, 2019, 2:06pm UTC](https://discuss.elastic.co/t/type-of-data-logs-to-start-with-elastic-geo-capabilities/195086/3 "2019-08-15T14:06:44Z")

</div>

But I guess it will only work if I have IP addresses in my logs, right?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 16, 2019, 12:32pm UTC](https://discuss.elastic.co/t/type-of-data-logs-to-start-with-elastic-geo-capabilities/195086/4 "2019-08-16T12:32:49Z")

</div>

yes, but the example above included one, thus my assumption this would be true. Do you have another use-case in mind?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 13, 2019, 12:41pm UTC](https://discuss.elastic.co/t/type-of-data-logs-to-start-with-elastic-geo-capabilities/195086/5 "2019-09-13T12:41:20Z")

</div>

Closed on September 13, 2019, 12:41pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.