# Use geoip plugin to load VLAN IDs

**URL:** <https://discuss.elastic.co/t/use-geoip-plugin-to-load-vlan-ids/181034>\
**Category:** Logstash\
**Created:** [May 14, 2019, 4:03pm UTC](https://discuss.elastic.co/t/use-geoip-plugin-to-load-vlan-ids/181034 "2019-05-14T16:03:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![yasvanth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yasvanth/32/45818_2.png) [@yasvanth](https://discuss.elastic.co/u/yasvanth)\
**Post date:** [May 14, 2019, 4:03pm UTC](https://discuss.elastic.co/t/use-geoip-plugin-to-load-vlan-ids/181034/1 "2019-05-14T16:03:49Z")

</div>

Hi Team,

I would like to know whether the my idea/approach is possible.

Using geoip plugin I need to query mmdb which contains list of network mapped to vlan id as given below:

netowork | vlan\_id| vlan\_description

```
geoip {
       source => "[flow][dst_addr]"
      database => NetworkVLAN.mmdb" 
      target => "[metadata][local_vlan_dst]"
      }
```

When If try use geoip filter I get `geoip_lookup_failuer`. Is it due that mmdb does cotains the feilds which are not support by geoip plugin such as `city_name` , `continent_code` , `country_code2` , `country_code3` , `country_name` , `dma_code` , `ip` , `latitude` , `longitude` , `postal_code` , `region_name` and `timezone` .

Thanks in advance.

Best,  
Yash

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 14, 2019, 4:46pm UTC](https://discuss.elastic.co/t/use-geoip-plugin-to-load-vlan-ids/181034/2 "2019-05-14T16:46:18Z")

</div>

The geoip filter has a [list](https://github.com/logstash-plugins/logstash-filter-geoip/blob/ed365076d59733325051cb52c31d05c1614384a9/src/main/java/org/logstash/filters/GeoIPFilter.java#L46) of database types that it understands. Is your database type one of those? If not, a geoip filter cannot read it.

---

<div class="post-metadata">

**Author:** ![yasvanth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yasvanth/32/45818_2.png) [@yasvanth](https://discuss.elastic.co/u/yasvanth)\
**Post date:** [May 15, 2019, 7:36am UTC](https://discuss.elastic.co/t/use-geoip-plugin-to-load-vlan-ids/181034/3 "2019-05-15T07:36:17Z")

</div>

Hi @Badger,

Thanks for your response, I am using MMDB format and Database type as GEOLite2-ASN but I have different column name, instead of "autonomous\_system\_number" and "autonomus\_organization" I used "vlan\_id" and "vlan\_description".

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 15, 2019, 12:40pm UTC](https://discuss.elastic.co/t/use-geoip-plugin-to-load-vlan-ids/181034/4 "2019-05-15T12:40:41Z")

</div>

It [knows](https://github.com/logstash-plugins/logstash-filter-geoip/blob/ed365076d59733325051cb52c31d05c1614384a9/src/main/java/org/logstash/filters/GeoIPFilter.java#L379) how to fetch ASN and ASO from a GEOLite2-ASN.

Given that you are fetching a number and a string, how about you don't change the column names? Otherwise, you are going to have to fork the filter code and add support for a new type.

---

<div class="post-metadata">

**Author:** ![yasvanth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yasvanth/32/45818_2.png) [@yasvanth](https://discuss.elastic.co/u/yasvanth)\
**Post date:** [May 15, 2019, 12:44pm UTC](https://discuss.elastic.co/t/use-geoip-plugin-to-load-vlan-ids/181034/5 "2019-05-15T12:44:50Z")

</div>

Hi @Badger,

By change the column names to default worked and I map the as\_org and asn to vlan\_descritpiton and vlan\_id using logstash mutate filter.

Thanks for the advice in future, I will fork the plugin if my database grows with more fields.

Best,  
Yash

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2019, 12:44pm UTC](https://discuss.elastic.co/t/use-geoip-plugin-to-load-vlan-ids/181034/6 "2019-06-12T12:44:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.